Vulnerability Description
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Solr | < 8.8.2 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425Mailing ListVendor Advisory
- https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed
- https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c87
- https://lists.apache.org/thread.html/r6ccec7fc54d82591b23c143f1f6a6e38f6e03e75db
- https://lists.apache.org/thread.html/r720a4a0497fc90bad5feec8aa18b777912ee15c7ee
- https://lists.apache.org/thread.html/r78a3a4f1138a1608b0c6d4a2ee7647848c1a20b0d5
- https://lists.apache.org/thread.html/r8f1152a43c36d878bbeb5a92f261e9efaf3af313b0
- https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586
- https://lists.apache.org/thread.html/rae9ccaecce9859f709ed1458545d90a4c07163070d
- https://lists.apache.org/thread.html/rd232d77c57a8ce172359ab098df9512d8b37373ab8
- https://lists.apache.org/thread.html/re9d64bb8e5dfefddcbf255adb4559e13a0df5b818d
- https://security.netapp.com/advisory/ntap-20210611-0009/Third Party Advisory
- https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425Mailing ListVendor Advisory
- https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed
- https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c87
FAQ
What is CVE-2021-27905?
CVE-2021-27905 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandle...
How severe is CVE-2021-27905?
CVE-2021-27905 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-27905?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Solr.