PT-2021-17659 · Apache · Apache Solr

Weinull Orz · Published 2021-04-13 · Updated 2026-01-09 · CVE-2021-27905

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache Solr versions prior to 8.8.2

Description: The ReplicationHandler in Apache Solr, normally registered at "/replication" under a Solr core, has a masterUrl (also leaderUrl alias) parameter used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a Server-Side Request Forgery (SSRF) issue, Solr should check these parameters against a similar configuration it uses for the shards parameter. Prior to the fix, this check was not performed.

Recommendations: For Apache Solr versions prior to 8.8.2, update to version 8.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the /replication endpoint to minimize the risk of exploitation. Additionally, restrict the use of the masterUrl and leaderUrl parameters until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BIT-SOLR-2021-27905

CVE-2021-27905

GHSA-5PHW-3JRP-3VJ8

Affected Products

Apache Solr

References · 43

• 🔥 https://github.com/Henry4E36/Solr-SSRF · Exploit
• 🔥 https://github.com/murataydemir/CVE-2021-27905 · Exploit
• 🔥 https://github.com/pdelteil/CVE-2021-27905.POC · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-27905 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-27905 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-27905 · Security Note
• https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425074a42eb326b10%40%3Cannounce.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5phw-3jrp-3vj8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27905 · Security Note
• https://osv.dev/vulnerability/BIT-solr-2021-27905 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-27905 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27905 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-27905 · Vendor Advisory
• https://github.com/henry4e36/solr-ssrf · Note
• https://twitter.com/Loginsoft_Intel/status/2009739670041833734 · Twitter Post