Apache Solr < 8.8.2 - Server-Side Request Forgery via ReplicationHandler masterUrl Parameter
Title source: llmExploitation Summary
CVE-2021-27905 has been observed exploited in the wild (reported by InTheWild.io). EIP tracks 5 public exploits from researchers including Henry4E36, murataydemir, pdelteil. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits CVE-2021-27905, an SSRF vulnerability in Apache Solr. It sends a crafted request to the Solr admin interface to trigger an SSRF via the replication endpoint, using a DNS log for verification.
Description
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
Exploits (5)
This PoC exploits CVE-2021-27905, an SSRF vulnerability in Apache Solr. It sends a crafted request to the Solr admin interface to trigger an SSRF via the replication endpoint, using a DNS log for verification.
This repository provides a detailed writeup and proof-of-concept for CVE-2021-27905, an SSRF vulnerability in Apache Solr's ReplicationHandler. It includes steps to enumerate core names and exploit the vulnerability via the `masterUrl` parameter.
This PoC demonstrates a Local File Inclusion (LFI) vulnerability in Apache Solr (CVE-2021-27905) by recursively traversing directories and reading file contents via the `debug/dump` endpoint. The script uses `curl` to exploit the vulnerability and parses responses to distinguish between directories and files.
This repository contains a functional proof-of-concept exploit for CVE-2021-27905, an SSRF vulnerability in Apache Solr versions prior to 8.8.2. The exploit leverages the `masterUrl` parameter in the replication handler to perform arbitrary HTTP requests.
This repository provides a writeup and Burp Suite repeatable steps for exploiting CVE-2021-27905, an SSRF vulnerability in Apache Solr. It includes an Xray detection plugin and a screenshot example but lacks direct exploit code.
Nuclei Templates (1)
cpe:"cpe:2.3:a:apache:solr" || http.title:"apache solr" || http.title:"solr admin"
title="solr admin" || title="apache solr"
References (12)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H