CVE-2021-27905 SSRF vulnerability with the Replication handler
Attackers can exploit the ReplicationHandler to perform Server-Side Request Forgery, accessing internal resources or bypassing network restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-27905?
CVE-2021-27905 is a critical server-side request forgery vulnerability in Apache Solr, published on 13 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
Weakness: CWE-918
Which versions are affected by CVE-2021-27905?
3 open source packages ship an affected version, including org.apache.solr:solr-parent and solr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.solr:solr-parent Maven | All versions | 8.8.2 |
org.apache.solr:solr-parent Maven | All versions | 8.8.2 |
solr Bitnami | All versions | 8.8.2 |
Products include Apache Solr.
How do I fix CVE-2021-27905?
Upgrade org.apache.solr:solr-parent to 8.8.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-27905 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-27905 exists.
Public exploit code: 1 Nuclei template and 5 proofs of concept on GitHub.
Other vulnerabilities in Apache Solr
- CVE-2019-17558 Apache Solr VelocityResponseWriter Plug-In Remote Code Execution
- CVE-2019-0193 Apache Solr DataImportHandler Code Injection
- CVE-2024-45216 Apache Solr: Authentication bypass possible using a fake URL Path ending
- CVE-2021-44548 Apache Solr information disclosure vulnerability through DataImportHandler
- CVE-2020-13957 Incorrect Authorization in Apache Solr
Sources
Also known as BIT-solr-2021-27905, DEBIAN-CVE-2021-27905, GHSA-5phw-3jrp-3vj8, UBUNTU-CVE-2021-27905.