CVE-2017-3164

Vulnerability

Apache Solr versions 1.3 through 7.6 (inclusive) are vulnerable to Server-Side Request Forgery (SSRF) because the shards parameter in distributed search requests does not enforce a whitelist mechanism [1]. An attacker can supply a URL in the shards parameter, and Solr will perform an HTTP GET request to that arbitrary address.

Exploitation

A remote attacker with network access to the Solr server can craft a request containing a malicious shards parameter pointing to an internal or external URL. No authentication or special privileges are required if the Solr API is exposed. The attacker simply sends the request; the server then initiates the HTTP GET to the target.

Impact

An attacker can leverage this SSRF to probe internal network services, read metadata from cloud endpoints (e.g., AWS/EC2 metadata), or interact with other internal systems reachable from the Solr server. The impact is information disclosure and potential lateral movement depending on network configuration.

Mitigation

Apache Solr 7.7 and later contain a fix that introduces a whitelist for the shards parameter [1]. Users should upgrade to 7.7 or newer. If upgrading is not immediately possible, restrict network access to the Solr API using firewalls or reverse proxy rules, and limit outbound HTTP requests from the server.