Improper Permission Assignment in Apache Solr's Schema Designer Feature

CVE-2023-50292

Summary

A vulnerability exists in the Schema Designer feature of Apache Solr, affecting several versions. The issue arises from an incorrect permission assignment for critical resources, allowing unauthenticated users to load external libraries in configSets. Although the feature was designed to facilitate easier configuration and testing of Schemas and configSets, it fails to validate the trust levels of these components. As a result, configSets created by unauthenticated users can be improperly leveraged, potentially leading to unauthorized remote code execution. Users are strongly encouraged to upgrade to version 9.3.0 to mitigate this vulnerability.

References