Potential Apache Solr CVE-2021-27905 Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•31

Detects exploitation attempts targeting CVE-2021-27905, an arbitrary file read and SSRF vulnerability affecting Apache Solr versions up to and including 8.8.1. The rule looks for specific patterns in HTTP request URIs that are indicative of this vulnerability being exploited, such as requests containing '/solr/', '/debug/dump?', 'param=ContentStream', or 'command=fetchindex' with 'masterUrl='.