Skip to content
Fencer Intel
critical 9.8

CVE-2021-27905 in the critical feed json

SSRF vulnerability with the Replication handler

published 5y ago modified 2mo ago also BIT-solr-2021-27905 , EUVD-2021-0959 , GHSA-5phw-3jrp-3vj8

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
93.1%
EPSS 93.1% chance of exploitation in 30 days, percentile 99.8%
public exploits
0
none known, plus a Nuclei check

Summary

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Patch / fix

  • maven org.apache.solr:solr-parent 8.8.2
  • bitnami solr 8.8.2
  • Apache Software Foundation Apache Solr 8.8.2
  • lucene-solr Debian 14, Debian 13, Debian 12 3.6.2+dfsg-23

debian advisories DEBIAN-CVE-2021-27905

  • solr Arch Linux 8.8.2-1

arch linux advisories AVG-1808

Is CVE-2021-27905 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-27905 updated cvss 8.1

solr: SSRF vulnerability with the Replication handler

  • Red Hat JBoss Data Virtualization 6 solr solr Red Hat JBoss Enterprise Application Platform 6 solr solr Red Hat JBoss Fuse 6 solr solr Red Hat JBoss Fuse Service Works 6 solr solr
    affected: workaround, no fix planned “Restrict access to the replication handler to only internal Solr instances.”
  • Red Hat Fuse 7 solr solr Red Hat Integration Camel K 1 camel-solr camel-solr Red Hat JBoss Web Server 3 solr solr
    not affected: vulnerable code not present “Restrict access to the replication handler to only internal Solr instances.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

93.05% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Nuclei template Apache Solr <=8.8.1 - Server-Side Request Forgery nuclei detection template

CVSS scores

assigned by version score vector
GitHub 3.1 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.solr:solr-parent
<8.8.2
8.8.2
bitnami solr
<8.8.2
8.8.2

Affected products

  • Apache Software Foundation Apache Solr

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.