CVE-2024-31391: 
vulnerability analysis and mitigation

CVE-2024-31391 is a sensitive information exposure vulnerability affecting the Apache Solr Operator versions 0.3.0 through 0.8.0. The vulnerability was discovered by Flip Hess and publicly disclosed in April 2024. The issue occurs when the Solr Operator is configured to bootstrap security with basic authentication and requires authentication for probe endpoints (Apache Security).

The vulnerability occurs when two specific conditions are met: (1) security is bootstrapped using the .solrOptions.security.authenticationType=basic option, and (2) authentication is required on probe endpoints via .solrOptions.security.probesRequireAuth=true. When these conditions are present, failed health check probes (including liveness, readiness, and startup probes) cause the Solr Operator to create Kubernetes events that contain the username and password of the 'k8s-oper' account, which the operator uses for its own requests to Solr (Apache Security).

The vulnerability exposes sensitive authentication credentials through Kubernetes events. If an attacker gains access to these events, they could obtain the 'k8s-oper' account credentials, potentially allowing unauthorized access to the Solr instance with operator-level privileges (Apache Security).

The vulnerability is exploitable when specific configuration options are enabled. An attacker with access to Kubernetes events could potentially view the exposed credentials when health check probes fail (Apache Security).

Users are recommended to upgrade to Solr Operator version 0.8.1, which fixes the issue by ensuring probes no longer print the credentials used for Solr requests. Alternatively, users can mitigate the vulnerability by disabling authentication on their healthcheck probes using the setting .solrOptions.security.probesRequireAuth=false (Apache Security).