Bug 1949516 (CVE-2021-27905)

Summary: CVE-2021-27905 solr: SSRF vulnerability with the Replication handler
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aboyko, aileenc, asoldano, atangrin, bbaranow, bibryam, bmaxwell, brian.stansberry, cdewolf, chazlett, csutherl, darran.lofthouse, dkreling, dosoudil, drieden, eleandro, fjuma, ggaughan, gmalinko, gvarsami, gzaronik, hbraun, iweiss, janstey, jclere, jcoleman, jochrist, jolee, jperkins, jschatte, jstastny, jwon, kconner, krathod, kwills, ldimaggi, lgao, msochure, msvehla, nwallace, pantinor, pjindal, pmackay, rguimara, rstancel, rsvoboda, rwagner, smaestri, szappis, tcunning, tkirby, tom.jenkinson, yborgess
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Solr 8.8.2 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in solr. The ReplicationHandler in Apache Solr does not check proper parameters when connecting to another Solr instance to replicate index data into the local core leading to a SSRF vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-05-05 20:33:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 1949524    

Description Guilherme de Almeida Suckevicz 2021-04-14 13:18:34 UTC
The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Reference:
https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425074a42eb326b10%40%3Cannounce.apache.org%3E

Comment 6 Eric Christensen 2021-05-03 13:17:37 UTC
Mitigation:

Restrict access to the replication handler to only internal Solr instances.

Comment 8 Product Security DevOps Team 2021-05-05 20:33:52 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27905