Description
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Solr | Apache Solr – < 8.8.2 | 8.8.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lucene-solr | 3.6.2+dfsg-23 | — |
| Debian 13 | lucene-solr | 3.6.2+dfsg-23 | — |
| Debian 12 | lucene-solr | 3.6.2+dfsg-23 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | lucene-solr | No fix yet | — |
| Ubuntu 26.04 LTS | lucene-solr | No fix yet | — |
| Ubuntu 25.10 | lucene-solr | No fix yet | — |
| Ubuntu 24.04 LTS | lucene-solr | No fix yet | — |
| Ubuntu 22.04 LTS | lucene-solr | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | lucene-solr | No fix yet | — |
| Ubuntu Pro 18.04 LTS | lucene-solr | No fix yet | — |
| Ubuntu Pro 16.04 LTS | lucene-solr | No fix yet | — |
| Ubuntu Pro 14.04 LTS | lucene-solr | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 5 repositories
-
Henry4E36/Solr-SSRF ★ 70 · Apr 21, 2021
Apache Solr SSRF(CVE-2021-27905)
-
murataydemir/CVE-2021-27905 ★ 6 · Aug 10, 2021
[CVE-2021-27905] Apache Solr ReplicationHandler Server Side Request Forgery (SSRF)
-
pdelteil/CVE-2021-27905.POC ★ 3 · Nov 3, 2022
POC for LFI related to CVE-2021-27905
-
RIZZZIOM/CVE-2021-27905 ★ 2 · Oct 18, 2025
Apache Solr < 8.8.2 Server Side Request Forgery
-
W2Ning/Solr-SSRF ★ 0 · Apr 25, 2021
CVE-2021-27905
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Solr <=8.8.1 - Server-Side Request Forgery http/cves/2021/CVE-2021-27905.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.solr:solr-parent | < 8.8.2 | 8.8.2 | GHSA-5phw-3jrp-3vj8 |
References
- https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425074a42eb326b10%40%3Cannounce.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210611-0009/
- [solr-users] 20210618 CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list
- [solr-users] 20210618 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list
- [solr-users] 20210728 Re: CVE-2021-27905 Apache Solr ReplicationHandler/SSRF vulnerability mailing-list
- [ofbiz-notifications] 20210914 [jira] [Updated] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) mailing-list
- [ofbiz-commits] 20210915 [ofbiz-plugins] branch release18.12 updated: Fixed: The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) (OFBIZ-12316) mailing-list
- [ofbiz-notifications] 20210915 [jira] [Commented] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) mailing-list
- [ofbiz-notifications] 20210915 [jira] [Closed] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) mailing-list
- [ofbiz-commits] 20210915 [ofbiz-plugins] branch trunk updated: Fixed: The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) (OFBIZ-12316) mailing-list
- [ofbiz-commits] 20210915 [ofbiz-plugins] branch release17.12 updated: Fixed: The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) (OFBIZ-12316) mailing-list
- [ofbiz-notifications] 20210915 [jira] [Updated] (OFBIZ-12316) The Solr version included in OFBiz has an SSRF vulnerability (CVE-2021-27905) mailing-list