The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ReplicationHandler (normally registered at /replication under a Solr core) in Apache Solr has a     masterUrl (also leaderUrl alias) parameter that is used to designate another ReplicationHandler on     another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought     to check these parameters against a similar configuration it uses for the shards parameter. Prior to     this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting     fixed in 8.8.2. (CVE-2021-27905)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a
    "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on
    another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought
    to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to
    this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting
    fixed in 8.8.2. (CVE-2021-27905)

The version of Apache Solr running on the remote host is 7.x prior to 7.7.4, or 8.x prior to 8.8.2. It is, therefore, affected by multiple vulnerabilities, including the following: 

  - The ReplicationHandler (normally registered at '/replication' under a Solr core) has a 'masterUrl' (also     'leaderUrl' alias) parameter that is used to designate another ReplicationHandler on another Solr core to     replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these     parameters against a similar configuration it uses for the 'shards' parameter. Prior to this bug getting     fixed, it did not. (CVE-2021-27905)

  - When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or     VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only     user is configured then Solr would not treat that node as a sensitive path and would allow it to be     readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not     automatically update the ACLs. (CVE-2021-29262)     
  - When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2     would forward/proxy distributed requests using server credentials instead of original client credentials.
    This would result in incorrect authorization resolution on the receiving hosts. (CVE-2021-29943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
255924	Linux Distros Unpatched Vulnerability : CVE-2021-27905	Nessus	Misc.	Local	critical
410958	SCA: security update for org.apache.solr:solr-parent (GHSA-5phw-3jrp-3vj8)	Tenable Cloud Security	SCA Checks	Local	critical
410958	SCA: security update for org.apache.solr:solr-parent (GHSA-5phw-3jrp-3vj8)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
181481	Apache Solr 7.x < 7.7.4 / 8.x < 8.8.2 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2021-27905

critical

Tenable Plugins

critical

critical

critical

critical