VYPR
← All advisories
Critical severityNVD Advisory· Published Dec 2, 2021· Updated Sep 16, 2024

Transmission of Private Resources into a New Sphere ('Resource Leak') and Exposure of Resource to Wrong Sphere in Crafter Search

CVE-2021-23264

Description

Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.craftercms:crafter-searchMaven
>= 3.1.0, < 3.1.153.1.15

Affected products

1

Patches

1
0e256ef0372c

Add access token for Crafter Search

https://github.com/craftercms/craftercmsJose RossMay 27, 2021via ghsa
commit
7 files changed · +20 −0
  • resources/deployer/config/base-target.yaml+2 −0 modified
    @@ -4,6 +4,8 @@ target:
   engineManagementToken: ${env:ENGINE_MANAGEMENT_TOKEN}
   search:
     serverUrl: ${env:SEARCH_URL}
+    accessToken:
+      value: ${env:SEARCH_ACCESS_TOKEN}
     elasticsearch:
       # Single Cluster
       urls:
  • resources/env/authoring/bin/crafter-setenv.sh+4 −0 modified
    @@ -124,6 +124,10 @@ export SEARCH_MANAGEMENT_TOKEN=${SEARCH_MANAGEMENT_TOKEN:="defaultManagementToke
 export PROFILE_MANAGEMENT_TOKEN=${PROFILE_MANAGEMENT_TOKEN:="defaultManagementToken"}
 export SOCIAL_MANAGEMENT_TOKEN=${SOCIAL_MANAGEMENT_TOKEN:="defaultManagementToken"}
 
+# -------------------- Access tokens ----------------
+# Please update this per installation and provide these tokens to the APIs.
+export SEARCH_ACCESS_TOKEN=${SEARCH_ACCESS_TOKEN:="defaultAccessToken"}
+
 # -------------------- Encryption variables --------------------
 # These variables are used to encrypt and decrypt values inside the configuration files.
 export CRAFTER_ENCRYPTION_KEY=${CRAFTER_ENCRYPTION_KEY:="default_encryption_key"}
  • resources/env/authoring/tomcat-config/crafter/engine/extension/server-config.properties+2 −0 modified
    @@ -2,6 +2,8 @@
 crafter.engine.site.default.rootFolder.path=file:${CRAFTER_DATA_DIR}/repos/sites/{siteName}/sandbox/
 # The URL of Crafter Search
 crafter.engine.search.server.url=${SEARCH_URL}
+# The value for the access token for Crafter Search
+crafter.engine.search.server.accessToken.value=${SEARCH_ACCESS_TOKEN}
 # The URL of Crafter Profile
 crafter.profile.rest.client.url.base=${PROFILE_URL}
 # If the Security Provider is enabled
  • resources/env/authoring/tomcat-config/crafter/search/extension/server-config.properties+3 −0 modified
    @@ -1,3 +1,6 @@
 crafter.search.solr.server.url=${SOLR_URL}
 # Search management authorization token
 crafter.search.management.authorizationToken=${SEARCH_MANAGEMENT_TOKEN}
+
+# Search access token
+crafter.search.api.access.token.value=${SEARCH_ACCESS_TOKEN}
  • resources/env/delivery/bin/crafter-setenv.sh+4 −0 modified
    @@ -98,6 +98,10 @@ export SEARCH_MANAGEMENT_TOKEN=${SEARCH_MANAGEMENT_TOKEN:="defaultManagementToke
 export PROFILE_MANAGEMENT_TOKEN=${PROFILE_MANAGEMENT_TOKEN:="defaultManagementToken"}
 export SOCIAL_MANAGEMENT_TOKEN=${SOCIAL_MANAGEMENT_TOKEN:="defaultManagementToken"}
 
+# -------------------- Access tokens ----------------
+# Please update this per installation and provide these tokens to the APIs.
+export SEARCH_ACCESS_TOKEN=${SEARCH_ACCESS_TOKEN:="defaultAccessToken"}
+
 # -------------------- Encryption variables --------------------
 export CRAFTER_ENCRYPTION_KEY=${CRAFTER_ENCRYPTION_KEY:="default_encryption_key"}
 export CRAFTER_ENCRYPTION_SALT=${CRAFTER_ENCRYPTION_SALT:="default_encryption_salt"}
  • resources/env/delivery/tomcat-config/crafter/engine/extension/server-config.properties+2 −0 modified
    @@ -4,6 +4,8 @@ crafter.engine.site.default.rootFolder.path=file:${CRAFTER_DATA_DIR}/repos/sites
 # crafter.engine.site.default.rootFolder.path=s3://crafter-serverless/sites/{siteName}
 # The URL of Crafter Search
 crafter.engine.search.server.url=${SEARCH_URL}
+# The value for the access token for Crafter Search
+crafter.engine.search.server.accessToken.value=${SEARCH_ACCESS_TOKEN}
 # The URL of Crafter Profile
 crafter.profile.rest.client.url.base=${PROFILE_URL}
 # If the Security Provider is enabled
  • resources/env/delivery/tomcat-config/crafter/search/extension/server-config.properties+3 −0 modified
    @@ -1,3 +1,6 @@
 crafter.search.solr.server.url=${SOLR_URL}
 # Search management authorization token
 crafter.search.management.authorizationToken=${SEARCH_MANAGEMENT_TOKEN}
+
+# Search access token
+crafter.search.api.access.token.value=${SEARCH_ACCESS_TOKEN}

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.