Vulnerabilities > CVE-2021-27905 - Server-Side Request Forgery (SSRF) vulnerability in Apache Solr

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

apache

CWE-918

critical

NVD

Published: 2021-04-13

Updated: 2023-11-07

Summary

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Solr - Apache Solr 1.1.0 Apache Solr 1.2 Apache Solr 1.2.0 Apache Solr 1.3.0 Apache Solr 1.4.0 Apache Solr 1.4.1 Apache Solr 3.1 Apache Solr 3.1.0 Apache Solr 3.2 Apache Solr 3.2.0 Apache Solr 3.3 Apache Solr 3.3.0 Apache Solr 3.4.0 Apache Solr 3.5.0 Apache Solr 3.6.0 Apache Solr 3.6.1 Apache Solr 3.6.2 Apache Solr 4.0.0 Apache Solr 4.1.0 Apache Solr 4.2.0 Apache Solr 4.2.1 Apache Solr 4.3.0 Apache Solr 4.3.1 Apache Solr 4.4.0 Apache Solr 4.5.0 Apache Solr 4.5.1 Apache Solr 4.6.0 Apache Solr 4.6.1 Apache Solr 4.7.0 Apache Solr 4.7.1 Apache Solr 4.7.2 Apache Solr 4.8.0 Apache Solr 4.8.1 Apache Solr 4.9.0 Apache Solr 4.9.1 Apache Solr 4.10.0 Apache Solr 4.10.1 Apache Solr 4.10.2 Apache Solr 4.10.3 Apache Solr 4.10.4 Apache Solr 5.0 Apache Solr 5.0.0 Apache Solr 5.1 Apache Solr 5.1.0 Apache Solr 5.2.0 Apache Solr 5.2.1 Apache Solr 5.3 Apache Solr 5.3.0 Apache Solr 5.3.1 Apache Solr 5.3.2 Apache Solr 5.4.0 Apache Solr 5.4.1 Apache Solr 5.5.0 Apache Solr 5.5.1 Apache Solr 5.5.2 Apache Solr 5.5.3 Apache Solr 5.5.4 Apache Solr 5.5.5 Apache Solr 6.0.0 Apache Solr 6.0.1 Apache Solr 6.1.0 Apache Solr 6.2.0 Apache Solr 6.2.1 Apache Solr 6.3.0 Apache Solr 6.4.0 Apache Solr 6.4.1 Apache Solr 6.4.2 Apache Solr 6.5.0 Apache Solr 6.5.1 Apache Solr 6.6.0 Apache Solr 6.6.1 Apache Solr 6.6.2 Apache Solr 6.6.3 Apache Solr 6.6.4 Apache Solr 6.6.5 Apache Solr 6.6.6 Apache Solr 7.0.0 Apache Solr 7.0.1 Apache Solr 7.1.0 Apache Solr 7.2.0 Apache Solr 7.2.1 Apache Solr 7.3.0 Apache Solr 7.3.1 Apache Solr 7.4.0 Apache Solr 7.5.0 Apache Solr 7.6.0 Apache Solr 7.7.0 Apache Solr 7.7.1 Apache Solr 7.7.2 Apache Solr 7.7.3 Apache Solr 8.0.0 Apache Solr 8.1.0 Apache Solr 8.1.1 Apache Solr 8.1.2 Apache Solr 8.2.0 Apache Solr 8.3.0 Apache Solr 8.3.1 Apache Solr 8.4.0 Apache Solr 8.4.1 Apache Solr 8.5.0 Apache Solr 8.5.1 Apache Solr 8.5.2 Apache Solr 8.6.0 Apache Solr 8.6.1 Apache Solr 8.6.2 Apache Solr 8.6.3 Apache Solr 8.8.1	111

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References