RIZZZIOM/CVE-2021-27905

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends an HTTP request to a vulnerable Apache Solr instance's ReplicationHandler with a user-supplied masterUrl parameter to trigger a Server-Side Request Forgery (SSRF).

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept exploit for CVE-2021-27905, an SSRF vulnerability in Apache Solr. The Python script (cve-2021-27905.py) sends a crafted HTTP request to a user-supplied target using a user-supplied payload URL. No backdoor, persistence, credential theft, or unrelated payload delivery was observed. The script's behavior is consistent with a standard SSRF PoC.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareApache Solr
Attack typesSSRF
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script cve-2021-27905.py actively sends a crafted HTTP request to a target Solr instance to make it fetch a resource from an attacker-specified URL, which is the definition of exercising the SSRF vulnerability. The README describes it as a Proof of Concept and provides exploitation instructions.

cve-2021-27905.py:1cve-2021-27905.py:50README.md:35README.md:54

Requirements

  • Target Apache Solr instance (version < 8.8.2) must be reachable over the network.cve-2021-27905.py:21
  • Attacker must supply a target URL and an SSRF payload URL.cve-2021-27905.py:21-22

Observed behavior

  • Parses command-line arguments for target, payload, and optional core name.cve-2021-27905.py:15-27
  • If no core name is provided, fetches the list of cores from /solr/admin/cores and selects the first one.cve-2021-27905.py:37-41
  • Constructs a URL targeting the replication handler with the attacker-controlled masterUrl parameter.cve-2021-27905.py:35cve-2021-27905.py:43
  • Sends an HTTP GET request to the constructed URL to trigger the SSRF.cve-2021-27905.py:50
  • Reports success or failure based on the HTTP response status code.cve-2021-27905.py:51-54
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script constructs a URL using user-supplied --target and --payload arguments and sends an HTTP GET request to trigger the SSRF vulnerability.This is the expected behavior for a CVE-2021-27905 PoC and does not indicate a backdoor.cve-2021-27905.py:35cve-2021-27905.py:50
Network Request
requests.get(targetUrl, verify=False, timeout=10)The script makes a single HTTP GET request to the constructed target URL. No data exfiltration or secondary requests to attacker-controlled infrastructure are hardcoded.cve-2021-27905.py:50
Review boundaries

What the analysis did not establish

  • Evidence includes a non-text media file (poc.gif) that was not analyzed.
  • The lab setup directory and Docker Compose file are not included in the selected text evidence.
  • One non-text media file (attachments/poc.gif, 4483719 bytes) was flagged as metadata-only and not analyzed for steganographic or embedded payloads.
  • One text file (lab/docker-compose.yml) was omitted from the packet and not reviewed.
  • The review does not assess the safety of executing the PoC against unauthorized systems.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

lab/docker-compose.yml

Created Vuln labCVE-2021-27905Compose · images

1 Compose manifest · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-service Docker Compose environment running Apache Solr 8.8.1, intended as a lab to demonstrate CVE-2021-27905 (SSRF).

lab/docker-compose.yml:1-9README.md:1-93

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a lab for CVE-2021-27905, provides setup and exploitation instructions, and the Compose file deploys the vulnerable Solr version.

README.md:1-5README.md:30-40lab/docker-compose.yml:3
Lab shapeCompose · images
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

solr

vulnerable target service

Apache Solr 8.8.1 container with a precreated 'gettingstarted' core, exposed on host port 127.0.0.1:8983. It is the target for the SSRF vulnerability.

lab/docker-compose.yml:2-9
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-27905

Supported by supplied evidence

The Compose file uses solr:8.8.1, which is within the affected version range (<8.8.2) stated in the README. The README describes the SSRF vulnerability and provides a PoC.

lab/docker-compose.yml:3README.md:13-15README.md:17-27
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the lab.README.md:32-33
  • Python 3 and pip are required to run the exploit script, along with the 'requests' library from requirements.txt.README.md:48-58requirements.txt:1

Evidence-described exercise path

  1. Start the lab with 'docker compose up -d' from the lab directory.README.md:33
  2. Verify Solr is accessible at http://127.0.0.1:8983/solr.README.md:36
  3. Set up a Python virtual environment and install requirements (requests).README.md:48-58
  4. Run the exploit script cve-2021-27905.py with a target and SSRF payload.README.md:60-62
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Compose file binds Solr only to localhost (127.0.0.1:8983), does not use privileged mode, mount host files, or define any network beyond the default bridge. The README describes a standard SSRF PoC against the lab's own target. No evidence of host escape, persistence, credential theft, or external connectivity beyond the documented exercise.

lab/docker-compose.yml:7lab/docker-compose.yml:1-9README.md:30-62
Review boundaries

What the analysis did not establish

  • The exploit script cve-2021-27905.py is not included in the evidence packet; its behavior cannot be assessed.
  • The repository contains additional files (total 5) not provided, which may include the exploit script or other artifacts.
  • The Compose file uses a default bridge network; no explicit network isolation is defined.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1