Skip to content
Fencer Vulns
high 8.8

CVE-2023-50386 in the critical feed json

Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets

published 2024-02-09 2 y ago modified 2026-09-10 1 mo ago also BIT-solr-2023-50386 , EUVD-2024-0481 , GHSA-37vr-vmg4-jwpw

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
83.7%
EPSS 83.7% chance of exploitation in 30 days, percentile 99.6%
public exploits
1
Metasploit

Summary

Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1.

In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API. When backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the default for backups). If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class files would be available to use with any ConfigSet, trusted or untrusted.

When Solr is run in a secure way (Authorization enabled), as is strongly suggested, this vulnerability is limited to extending the Backup permissions with the ability to add libraries. Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue. In these versions, the following protections have been added:

* Users are no longer able to upload files to a configSet that could be executed via a Java ClassLoader. * The Backup API restricts saving backups to directories that are used in the ClassLoader.

Patch / fix

  • maven org.apache.solr:solr-core 8.11.3, 9.4.1
  • bitnami solr 8.11.3, 9.4.1
  • Apache Software Foundation Apache Solr 9.4.1
  • lucene-solr Debian 14, Debian 13, Debian 12 3.6.2+dfsg-23

debian advisories DEBIAN-CVE-2023-50386

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-50386 updated cvss 7.5

solr: backup/restore APIs allow for deployment of executables in malicious ConfigSets

  • Red Hat Data Grid 8 solr solr Red Hat Fuse 7 solr solr Red Hat Integration Camel K 1 camel-solr camel-solr Red Hat JBoss Enterprise Application Platform 6 solr-core Red Hat JBoss Enterprise Application Platform 8 solr-core
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (Metasploit exploit/linux/http/apache_solr_backup_restore)

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

83.72% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.solr:solr-core
>=6.0.0, <8.11.3
>=9.0.0, <9.4.1
8.11.3
9.4.1
bitnami solr
>=6.0.0, <8.11.3
>=9.0.0, <9.4.1
8.11.3
9.4.1

Affected products

  • Apache Software Foundation Apache Solr
  • apache solr

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type
  • CWE-913 Improper Control of Dynamically-Managed Code Resources

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.