Vulnerability record · CVE-2021-27905 · published 13 April 2021
CVE-2021-27905: Apache Solr ReplicationHandler masterUrl SSRF flaw
Apache · Solr
Apache Solr's ReplicationHandler, normally exposed at /replication under a Solr core, accepts a masterUrl (leaderUrl) parameter without validating it against the same configuration used for the shards parameter. This allows server-side request forgery, and the flaw affects essentially all Solr versions prior to the fix in 8.8.2.
Description
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS probability, though KEV listing is absent.
What it is
Apache Solr's ReplicationHandler, normally exposed at /replication under a Solr core, accepts a masterUrl (leaderUrl) parameter without validating it against the same configuration used for the shards parameter. This allows server-side request forgery, and the flaw affects essentially all Solr versions prior to the fix in 8.8.2.
Impact
An attacker can make the Solr server issue requests to arbitrary URLs, reaching internal services or metadata endpoints that are not otherwise exposed. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network via the ReplicationHandler endpoint using the masterUrl or leaderUrl parameter; the CVSS vector indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high at 0.93053 (99.8th percentile), indicating strong likelihood of attempted exploitation. Reference tags are vendor advisory, mailing list and third-party advisory only, with no public exploit tag supplied.
What to do
- Upgrade Apache Solr to 8.8.2 or later, which contains the fix.
- If upgrade is not immediately possible, restrict network access to the /replication endpoint to trusted hosts only.
- Block outbound traffic from Solr servers to internal networks and cloud metadata addresses.
- Run Solr with least privilege and avoid exposing it directly to untrusted networks.
Detection
- Review Solr request logs for calls to /replication with masterUrl or leaderUrl parameters.
- Monitor outbound connections from Solr hosts to unexpected internal or metadata IP addresses.
- Alert on ReplicationHandler requests originating from untrusted source addresses.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-27905 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-27905), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
