CVE-2021-27905: Server-Side Request Forgery (SSRF)

May 10, 2021 (updated September 16, 2021)

The ReplicationHandler (normally registered at “/replication” under a Solr core) in Apache Solr has a “masterUrl” (also “leaderUrl” alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the “shards” parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

References

github.com/advisories/GHSA-5phw-3jrp-3vj8
nvd.nist.gov/vuln/detail/CVE-2021-27905

Detect and mitigate CVE-2021-27905 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →