{"id":"CVE-2021-27905","published":"2021-04-13T06:35:20Z","modified":"2024-08-03T21:33:16Z","title":"SSRF vulnerability with the Replication handler","vendor":"Apache Software Foundation","product":"Apache Solr","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Solr","versions":[">= Apache Solr, < 8.8.2"]}],"description":{"text":"The ReplicationHandler (normally registered at \"/replication\" under a Solr core) in Apache Solr has a \"masterUrl\" (also \"leaderUrl\" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the \"shards\" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.93053,"percentile":0.99832,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes","url":"https://otx.alienvault.com/pulse/61695dd13611f59694746cda","created":"2021-10-15"}],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425074a42eb326b10%40%3Cannounce.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20210611-0009/","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.apache.org/thread.html/r95df34bb158375948da82b4dfe9a1b5d528572d586584162f8f5aeef%40%3Cusers.solr.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r140128dc6bb4f4e0b6a39e962c7ca25a8cbc8e48ed766176c931fccc%40%3Cusers.solr.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r3da74965aba2b5f5744b7289ad447306eeb2940c872801819faa9314%40%3Cusers.solr.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rae9ccaecce9859f709ed1458545d90a4c07163070dc98b5e9e59057f%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r720a4a0497fc90bad5feec8aa18b777912ee15c7eeb5f882adbf523e%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/re9d64bb8e5dfefddcbf255adb4559e13a0df5b818da1b9b51329723f%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rd232d77c57a8ce172359ab098df9512d8b37373ab87c444be911b430%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r78a3a4f1138a1608b0c6d4a2ee7647848c1a20b0d5c652cd9b02c25a%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r6ccec7fc54d82591b23c143f1f6a6e38f6e03e75db70870e4cb14a1a%40%3Ccommits.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r8f1152a43c36d878bbeb5a92f261e9efaf3af313b033d7acfccea59d%40%3Cnotifications.ofbiz.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.solr:solr-parent","vulnerableRanges":["<8.8.2"],"patched":["8.8.2"],"from":["GHSA-5phw-3jrp-3vj8"],"provenance":"source"}],"advisories":[{"id":"GHSA-5phw-3jrp-3vj8","url":"https://github.com/advisories/GHSA-5phw-3jrp-3vj8","severity":"HIGH","ecosystem":"Maven","package":"org.apache.solr:solr-parent","vulnerableRanges":["<8.8.2"],"patched":["8.8.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-0959","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0959","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2021-04-21","earliestUrl":"https://github.com/Henry4E36/Solr-SSRF","repos":[{"name":"Henry4E36/Solr-SSRF","url":"https://github.com/Henry4E36/Solr-SSRF","stars":70,"created":"2021-04-21"},{"name":"murataydemir/CVE-2021-27905","url":"https://github.com/murataydemir/CVE-2021-27905","stars":6,"created":"2021-08-10"},{"name":"pdelteil/CVE-2021-27905.POC","url":"https://github.com/pdelteil/CVE-2021-27905.POC","stars":3,"created":"2022-11-03"},{"name":"RIZZZIOM/CVE-2021-27905","url":"https://github.com/RIZZZIOM/CVE-2021-27905","stars":2,"created":"2025-10-18"},{"name":"W2Ning/Solr-SSRF","url":"https://github.com/W2Ning/Solr-SSRF","stars":0,"created":"2021-04-25"}]},"nuclei":[{"id":"CVE-2021-27905","name":"Apache Solr <=8.8.1 - Server-Side Request Forgery","severity":"critical","path":"http/cves/2021/CVE-2021-27905.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27905.yaml"}],"first":{"date":"2021-04-21","source":"PoC-in-GitHub","url":"https://github.com/Henry4E36/Solr-SSRF"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential CVE-2021-27905 Exploitation Attempt","id":"0bbcd74b-0596-41a4-94a0-4e88a76ffdb3","level":"medium","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-27905/web_cve_2021_27905_apache_solr_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-27905/web_cve_2021_27905_apache_solr_exploit.yml","techniques":["T1190"]}]},"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-04-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-27905","provenance":"source"},{"date":"2021-04-21","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Henry4E36/Solr-SSRF","provenance":"source"}],"speed":{"daysToPublicExploit":8,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":25.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9983"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2018-11802","published":"2020-04-01","fixed":"7.7.0","kev":false},{"cve":"CVE-2020-13941","published":"2020-08-17","fixed":"8.6.0","kev":false},{"cve":"CVE-2020-13957","published":"2020-10-13","fixed":"8.6.3","kev":false,"link":{"from":"CVE-2020-13957","to":"CVE-2021-27905","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.solr:solr-parent","fromFixed":"8.6.3","toFixed":"8.8.2","daysApart":182}]}},{"cve":"CVE-2021-27905","published":"2021-04-13","fixed":"8.8.2","kev":false},{"cve":"CVE-2021-29943","published":"2021-04-13","fixed":"8.8.2","kev":false},{"cve":"CVE-2021-44548","published":"2021-12-23","fixed":"8.11.1","kev":false}],"package":"Maven:org.apache.solr:solr-parent"}}