CVE-2021-44548
📋 TL;DR
This vulnerability in Apache Solr's DataImportHandler allows attackers to make SMB network calls from the Solr host to other systems by providing Windows UNC paths. This can lead to credential theft via NTLM hash capture or potentially remote code execution through SMB relay attacks. Only affects Windows systems running Apache Solr versions prior to 8.11.1.
💻 Affected Systems
- Apache Solr
📦 What is this software?
Solr by Apache
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through SMB relay attacks leading to full system compromise of the Solr host or other systems on the network.
Likely Case
Credential theft via NTLM hash capture, enabling lateral movement within the network and potential privilege escalation.
If Mitigated
Limited to information disclosure if SMB signing is enforced and network segmentation prevents access to critical systems.
🎯 Exploit Status
Exploitation requires network access to Solr instance and ability to trigger DataImportHandler with malicious UNC path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apache Solr 8.11.1 and later
Vendor Advisory: https://solr.apache.org/security.html#cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandler
Restart Required: Yes
Instructions:
1. Download Apache Solr 8.11.1 or later from official site. 2. Backup current configuration and data. 3. Stop Solr service. 4. Replace with patched version. 5. Restart Solr service.
🔧 Temporary Workarounds
Disable DataImportHandler
allRemove or disable DataImportHandler if not required
Remove DataImportHandler configuration from solrconfig.xml or set enabled="false"
Network Segmentation
windowsRestrict outbound SMB traffic from Solr hosts
Windows Firewall: New-OutboundFirewallRule -DisplayName "Block Solr SMB" -Direction Outbound -Protocol TCP -RemotePort 445 -Action Block
🧯 If You Can't Patch
- Enforce SMB signing on all Windows systems to prevent relay attacks
- Implement strict network segmentation to isolate Solr hosts from critical systems
🔍 How to Verify
Check if Vulnerable:
Check Solr version and OS: version < 8.11.1 AND OS = Windows AND DataImportHandler accessibleCheck Version:
solr version (from command line) or check Solr admin UIVerify Fix Applied:
Confirm Solr version is 8.11.1 or later and test DataImportHandler with UNC paths returns error📡 Detection & Monitoring
Log Indicators:
- UNC path patterns in Solr logs (\\server\share)
- DataImportHandler requests with unusual file paths
- Failed SMB connection attempts from Solr host
Network Indicators:
- Unexpected SMB traffic originating from Solr hosts to internal systems
- NTLM authentication attempts from Solr to unexpected targets
SIEM Query:
source="solr.log" AND ("UNC" OR "\\\\" OR "DataImportHandler")🔗 References
- https://security.netapp.com/advisory/ntap-20220114-0005/
- https://solr.apache.org/security.html#cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandler
- https://security.netapp.com/advisory/ntap-20220114-0005/
- https://solr.apache.org/security.html#cve-2021-44548-apache-solr-information-disclosure-vulnerability-through-dataimporthandler
