CVE-2021-44548 Apache Solr information disclosure vulnerability through DataImportHandler
Attackers can trigger SMB network calls via UNC paths in DataImportHandler, potentially leaking credentials or enabling remote code execution on Windows hosts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-44548?
CVE-2021-44548 is a critical server-side request forgery vulnerability in Apache Solr, published on 23 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.
Which versions are affected by CVE-2021-44548?
3 open source packages ship an affected version, including org.apache.solr:solr-parent and solr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.solr:solr-parent Maven | All versions | 8.11.1 |
org.apache.solr:solr-parent Maven | All versions | 8.11.1 |
solr Bitnami | All versions | 8.11.1 |
Products include Apache Solr.
How do I fix CVE-2021-44548?
Upgrade org.apache.solr:solr-parent to 8.11.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-44548 being exploited?
There is no known exploitation of CVE-2021-44548 in the wild and no public exploit code.
Other vulnerabilities in Apache Solr
- CVE-2019-17558 Apache Solr VelocityResponseWriter Plug-In Remote Code Execution
- CVE-2019-0193 Apache Solr DataImportHandler Code Injection
- CVE-2024-45216 Apache Solr: Authentication bypass possible using a fake URL Path ending
- CVE-2021-27905 SSRF vulnerability with the Replication handler
- CVE-2020-13957 Incorrect Authorization in Apache Solr
Sources
Also known as BIT-solr-2021-44548, GHSA-pccr-q7v9-5f27.