Bug 1949516 (CVE-2021-27905)

Summary:	CVE-2021-27905 solr: SSRF vulnerability with the Replication handler
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aboyko, aileenc, asoldano, atangrin, bbaranow, bibryam, bmaxwell, brian.stansberry, cdewolf, chazlett, csutherl, darran.lofthouse, dkreling, dosoudil, drieden, eleandro, fjuma, ggaughan, gmalinko, gvarsami, gzaronik, hbraun, iweiss, janstey, jclere, jcoleman, jochrist, jolee, jperkins, jschatte, jstastny, jwon, kconner, krathod, kwills, ldimaggi, lgao, msochure, msvehla, nwallace, pantinor, pjindal, pmackay, rguimara, rstancel, rsvoboda, rwagner, smaestri, szappis, tcunning, tkirby, tom.jenkinson, yborgess
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Solr 8.8.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in solr. The ReplicationHandler in Apache Solr does not check proper parameters when connecting to another Solr instance to replicate index data into the local core leading to a SSRF vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-05 20:33:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1949524

Description Guilherme de Almeida Suckevicz 2021-04-14 13:18:34 UTC

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Reference:
https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425074a42eb326b10%40%3Cannounce.apache.org%3E

Comment 6 Eric Christensen 2021-05-03 13:17:37 UTC

Mitigation:

Restrict access to the replication handler to only internal Solr instances.

Comment 8 Product Security DevOps Team 2021-05-05 20:33:52 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27905