Vulnerability · Published Apr 13, 2021 · Assigned by apache

CVE-2021-27905SSRF vulnerability with the Replication handler

Critical 9.8

In plain English

A critical-severity server-side request forgery in Apache Solr from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 93.1% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)93.1%top 0.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling2Nuclei, Public PoC

Official description

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	lucene-solr	3.6.2+dfsg-23	DEBIAN-CVE-2021-27905
Debian:13	lucene-solr	3.6.2+dfsg-23	DEBIAN-CVE-2021-27905
Debian:14	lucene-solr	3.6.2+dfsg-23	DEBIAN-CVE-2021-27905
Maven	org.apache.solr:solr-parent	8.8.2	GHSA-5phw-3jrp-3vj8
Ubuntu:22.04:LTS	lucene-solr	no fix listed	UBUNTU-CVE-2021-27905
Ubuntu:24.04:LTS	lucene-solr	no fix listed	UBUNTU-CVE-2021-27905
Ubuntu:25.10	lucene-solr	no fix listed	UBUNTU-CVE-2021-27905
Ubuntu:26.04:LTS	lucene-solr	no fix listed	UBUNTU-CVE-2021-27905
Ubuntu:26.10	lucene-solr	no fix listed	UBUNTU-CVE-2021-27905

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Solr	Apache Solr – before 8.8.2

Weakness: CWE-918

References

https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425074a42eb326b10%40%3Cannounce.apache.org%3E x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210611-0009/ x_refsource_CONFIRM
[solr-users] 20210618 CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list, x_refsource_MLIST
[solr-users] 20210618 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list, x_refsource_MLIST
[solr-users] 20210728 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list, x_refsource_MLIST
[ofbiz-notifications] 20210914 [jira] [Updated] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) mailing-list, x_refsource_MLIST
[ofbiz-commits] 20210915 [ofbiz-plugins] branch release18.12 updated: Fixed: The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) (OFBIZ-12316) mailing-list, x_refsource_MLIST
[ofbiz-notifications] 20210915 [jira] [Commented] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) mailing-list, x_refsource_MLIST
[ofbiz-notifications] 20210915 [jira] [Closed] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) mailing-list, x_refsource_MLIST
[ofbiz-commits] 20210915 [ofbiz-plugins] branch trunk updated: Fixed: The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) (OFBIZ-12316) mailing-list, x_refsource_MLIST
[ofbiz-commits] 20210915 [ofbiz-plugins] branch release17.12 updated: Fixed: The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) (OFBIZ-12316) mailing-list, x_refsource_MLIST
[ofbiz-notifications] 20210915 [jira] [Updated] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) mailing-list, x_refsource_MLIST