Apache Solr information disclosure vulnerability through DataImportHandler

Vulnerability

CVE-2021-44548 is an Improper Input Validation vulnerability in Apache Solr's DataImportHandler. The handler does not sanitize user-supplied Windows UNC paths (\\host\share), causing the Solr server to initiate an SMB connection to the remote host when processing such a path. This flaw affects all Apache Solr versions prior to 8.11.1 and is exclusive to Windows deployments [1][2].

Exploitation

An attacker with the ability to submit a crafted data import configuration — via the DataImportHandler API or by uploading a valid configuration — can supply a UNC path as the source of data. The Solr server will then attempt to access the specified network share, sending an SMB request. No special network position is required beyond reachability of the Solr endpoint; the attacker may be on the same LAN or could coax an internal user to import a malicious configuration [1].

Impact

Successful exploitation leaks the Windows OS user's NTLM/LM password hashes to the attacker's SMB server. In misconfigured environments, an SMB Relay attack can be performed, potentially leading to user impersonation on SMB shares or, in worst cases, remote code execution on other systems that trust the Solr host's credentials. The disclosure of hashes alone already enables offline cracking and lateral movement [1].

Mitigation

Apache Solr 8.11.1, released on 2021-12-23, disables UNC path support by default in the DataImportHandler. Users of affected Windows versions must upgrade to 8.11.1 or later. For environments that cannot immediately upgrade, network-level controls such as blocking outbound SMB (port 445) from the Solr server to untrusted hosts are advised as workarounds [1][2].