This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Apache Solr < 8.8.2 has an SSRF flaw. π **Consequences**: Attackers use `masterUrl` to replicate index data to local cores.β¦
π‘οΈ **Root Cause**: CWE-918 (SSRF). The `ReplicationHandler` accepts `masterUrl`/`leaderUrl` without validating against internal config. It trusts external URLs blindly, allowing internal network access.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: Apache Solr versions **8.8.2 and prior**. π’ **Vendor**: Apache Software Foundation. π **Published**: April 13, 2021.
Q4What can hackers do? (Privileges/Data)
π **Hackers Can**: 1. Scan internal networks via SSRF. 2. Read local files (LFI) if traversal is supported. 3. Access internal services (DBs, APIs) that are not exposed publicly.β¦
β‘ **Threshold**: **LOW**. No authentication required for the replication handler endpoint by default. Configuration is often exposed. Easy to trigger via HTTP requests.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Public Exp?**: **YES**. Multiple PoCs exist on GitHub (e.g., `Solr-SSRF`, `CVE-2021-27905.POC`). Tools like Nuclei have templates. Wild exploitation is possible using simple scripts.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: 1. Use Nuclei template `CVE-2021-27905.yaml`. 2. Run Python PoC scripts with `-u URL -d dnslog`. 3. Check if `/replication` endpoint is accessible and accepts `masterUrl`.
Q8Is it fixed officially? (Patch/Mitigation)
β **Fixed?**: **YES**. Official patch released in **Apache Solr 8.8.2**. Upgrade to this version or later to resolve the SSRF flaw in `ReplicationHandler`.
Q9What if no patch? (Workaround)
π§ **No Patch?**: 1. Block `/replication` endpoint via WAF/Nginx. 2. Disable `ReplicationHandler` if not needed. 3. Restrict network access to Solr ports. 4. Validate `masterUrl` inputs if custom code.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: **HIGH**. Critical SSRF flaw with public exploits. Affects widely used search servers. Immediate patching or mitigation is recommended to prevent internal network compromise.