CVE-2021-27905 PoC — SSRF vulnerability with the Replication handler

Source

https://github.com/pdelteil/CVE-2021-27905.POC

Associated Vulnerability

Title: SSRF vulnerability with the Replication handler (CVE-2021-27905)
Description:The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.

Description

POC for LFI related to CVE-2021-27905

Readme

# CVE-2021-27905.POC
POC for LFI related to CVE-2021-27905

POC for [apache-solr-file-read nuclei template](https://github.com/projectdiscovery/nuclei-templates/blob/master/vulnerabilities/apache/apache-solr-file-read.yaml)

# Use 

`traverse.sh path`

For example, using /root as path, will display the content of all files (recursively) 

`> ./traverse.sh /root ` 

It's also possible to traverse and get the content of every file on the server (with reading privileges obviously) 

`> ./traverse.sh / ` 


# Documentation

The response from the vulnerable solr instance returns a `status code` the interesting values are: 

```
status: 0 -> OK 
status: 500 -> denied/forbidden. 
``` 
After that I needed to check if the response was the content of a file of a list of files and folders. To do this I just counted how many spaces the param `stream` had. Afortunately there were only 2 cases:

```
# spaces = 0  -> list of files and folders
# spaces > 0  -> content of a file. 

```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →