CVE-2021-27905

CRITICAL IN THE WILD NUCLEI LAB

Apache Solr - SSRF

Title source: llm

Description

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Exploits (5)

nomisec WORKING POC 71 stars
by Henry4E36 · poc
https://github.com/Henry4E36/Solr-SSRF
nomisec WRITEUP 5 stars
by murataydemir · poc
https://github.com/murataydemir/CVE-2021-27905
nomisec WORKING POC 3 stars
by pdelteil · poc
https://github.com/pdelteil/CVE-2021-27905.POC
nomisec WORKING POC 2 stars
by RIZZZIOM · poc
https://github.com/RIZZZIOM/CVE-2021-27905
nomisec WRITEUP
by W2Ning · poc
https://github.com/W2Ning/Solr-SSRF

Nuclei Templates (1)

Apache Solr <=8.8.1 - Server-Side Request Forgery
CRITICALby hackergautam
Shodan: cpe:"cpe:2.3:a:apache:solr" || http.title:"apache solr" || http.title:"solr admin"
FOFA: title="solr admin" || title="apache solr"

References (12)

Scores

CVSS v3 9.8
EPSS 0.9390
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Lab Environment

COMMUNITY
Community Lab
docker pull solr:8.8.1
+2 more repos

Details

InTheWild.io 2021-04-18
CWE
CWE-918
Status published
Products (2)
apache/solr < 8.8.2
org.apache.solr/solr-parent 0 - 8.8.2Maven
Published Apr 13, 2021
Tracked Since Feb 18, 2026