Apache Solr SSRF and Credential-Testing Activity Targeting Mexican and Colombian Public-Sector Organizations
By Threat Intelligence Unit
Overview
Recovered server-side artifacts document two sets of activity targeting public-sector organizations in Mexico and Colombia.
In the Mexican case, shell history and Python tooling show an attempt to use Apache Solr CVE-2021-27905 against a public-sector organization. The invoked command contained a PostgreSQL-formatted query seeking email and password data, but the available artifacts contain no target response, extracted records, or other evidence that the request reached the intended internal service.
Separately, shell scripts tested 243 candidate email-and-password entries against Colombian public-sector login services. The scripts classified responses using HTTP status codes and response-size thresholds. Although the attacker-generated output classified 98 FortiGate-related results as heuristic matches, those records reduced to 57 unique credential pairs and none could be independently confirmed as a successful authentication.
Evidence boundary: This report establishes attempted exploitation and credential testing from recovered attacker-side artifacts. It does not establish successful SQL execution, data retrieval, valid passwords, authenticated sessions, MFA completion, VPN access, or follow-on compromise.
Key Findings
- Recovered shell history records one invocation of tooling configured for a
Mexican public-sectortarget and a query seeking email and password data. - The Python tooling implemented an SSRF chain consistent with
CVE-2021-27905, but the target's Apache Solr version and configuration were not independently verified. - The Colombian credential file contained 243 candidate entries, including duplicates.
- The attacker-generated
hits2.txtcontained 98 FortiGate heuristic-match records, representing 57 unique username-password pairs after deduplication. - Zero successful authentications were independently confirmed from the available artifacts.
Infrastructure Analysis
The shell history, scripts, credential list, and result files were recovered from a server accessible at the following address:
- IP Address:
157.254.194[.]249 - Geolocation at time of analysis: United States
- Origin Prefix:
157.254.194.0/24 - Origin ASN:
AS399486(VIRTUO) - ASN Registrant: 12651980 Canada Inc.
- Covering Allocation:
157.254.192.0/20(NETUTILS, Internet Utilities NA LLC)
At the time of the lookup on 24 August 2026, RIPEstat routing data identified 157.254.194.0/24 as announced by AS399486. ARIN's ASN record identifies that autonomous system as VIRTUO, registered to 12651980 Canada Inc., while ARIN's address record places the IP within the broader 157.254.192.0/20 allocation registered as NETUTILS to Internet Utilities NA LLC.
ASN and address-registration records identify routing and allocation relationships; they do not establish the physical server location, customer identity, infrastructure ownership, or responsibility for the observed activity. The original publication record does not retain the geolocation provider, precise collection timestamp, time zone, or cryptographic hashes of the recovered artifacts. The server's role is therefore described as artifact-hosting infrastructure; the available files alone do not establish ownership or exclusive control.
Two-track public-sector activity
Exploitation Flow
Recovered artifacts document two independent paths; the evidence does not establish a shared intrusion chain or a confirmed compromise.
Track A · Mexico
Apache Solr SSRF Attempt
- 01Target and query configurationobservedexploit-real.py was configured for a redacted Mexican public-sector host and a PostgreSQL-formatted query.
- 02Initial request constructionobservedThe outer request used the configured /update/extract path to reach an internal Solr service.
- 03ReplicationHandler SSRF attemptassessedAn internal /replication request carried an attacker-controlled masterUrl consistent with CVE-2021-27905.
- 04Intended internal accessunconfirmedThe chain was designed to route the supplied query toward an internal service.
Outcome unconfirmedNo response logs, returned data, or victim-side telemetry confirm that the SSRF chain completed or the query executed.
Track B · Colombia
Credential-Testing Activity
- 01Candidate credential ingestionobservedThe scripts loaded 243 email-and-password entries, including duplicates.
- 02Multi-service authentication testingobservedMail, FortiGate, ADFS, SharePoint, and other web login endpoints were tested.
- 03Heuristic result classificationobservedHTTP status-code and response-size conditions produced 98 FortiGate heuristic matches.
- 04Deduplication and validationunconfirmedThe results represented 57 unique credential pairs after duplicate pairs were removed.
0 confirmed authenticationsNo authenticated session, completed MFA flow, VPN tunnel, or victim-side authentication record was recovered.
Relationship boundaryThe common artifact server does not by itself establish that the Mexican and Colombian targets belonged to one coordinated operation.
Attempted Apache Solr SSRF Targeting Mexico
The recovered artifacts show an attempt to exploit the Apache Solr SSRF vulnerability CVE-2021-27905 against a Mexican public-sector organization:
- Target:
[REDACTED] - Sector: Public sector
The attacker's bash_history contained a command invoking exploit-real.py with a PostgreSQL-formatted SQL payload intended to retrieve sensitive information, including email addresses and passwords. The command history establishes invocation and intent; it does not establish that the target accepted the request or executed the query.
Figure 1. bash_history showing exploit-real.py invoked with a PostgreSQL-formatted SQL payload
Analysis of exploit-real.py found that the outer request used the configured /update/extract path to reach an internal Solr service. A separate function then constructed a request to the internal /replication handler with an attacker-controlled masterUrl value, as shown in Figure 3.
This second step is consistent with CVE-2021-27905, an SSRF vulnerability in Apache Solr's ReplicationHandler caused by insufficient validation of the masterUrl and leaderUrl parameters. The issue affects Apache Solr versions before 8.8.2 (NVD, Apache Solr security advisories). The recovered artifacts do not independently establish the target's Solr version, whether the required handler was reachable, or whether the full request chain completed.
No response logs, target-side telemetry, query results, or extracted records were identified. Successful SSRF, SQL execution, and data retrieval therefore remain unconfirmed.
Figure 2. exploit-real.py configured for Solr SSRF via the /update/extract path
Figure 3. CVE-2021-27905 targeting via /replication and masterUrl
Credential-Testing Activity Targeting Colombia
For the activity targeting Colombian government-related domains, the recovered artifacts contained shell scripts (.sh) rather than the Python script (.py) used in the attempt against the Mexican target.
- Target:
[REDACTED] - Sector: Colombian government agency
The attack.sh script tested candidate credentials stored in [REDACTED]_creds.txt, which contained 243 email-and-password entries, including duplicates. The source and validity of those password values could not be established from the recovered artifacts.
The script tested the credentials against:
- FortiGate
- Active Directory Federation Services (ADFS)
Figure 4. [REDACTED]_creds.txt containing candidate Colombian public-sector credential pairs
Figure 5. attack.sh testing candidate credentials against Mail, FortiGate, and ADFS
The script classified server responses and saved the resulting HTTP metadata to all_results.csv. These classifications did not independently establish credential validity.
Figure 6. all_results.csv recording credential-test results against Outlook Web Access
A second script, fast_attack2.sh, attempted authentication against four login-related domains using credentials stored in [REDACTED]_creds.txt.
The script classified results as heuristic matches based on predefined HTTP response-size thresholds or specific status codes. The attacker-generated hits2.txt file contained 98 FortiGate-related heuristic-match entries. After duplicate username-password pairs were removed, 57 unique credential pairs remained.
However, the available artifacts contained no evidence of valid authenticated sessions, post-login access to protected resources, completed MFA, established VPN tunnels, or victim-side authentication logs. Therefore, the heuristic-match entries could not be independently confirmed as successful authentications.
Credential-Testing Evidence Funnel
| Stage | Count | Established Outcome |
|---|---|---|
| Candidate credential file | 243 entries | Email-and-password strings recovered; includes duplicates |
| FortiGate heuristic matches | 98 records | Responses met the script's status-code or response-size conditions |
| Deduplicated FortiGate results | 57 credential pairs | Unique username-password pairs represented in the heuristic results |
| Independently confirmed authentication | 0 | No session, MFA, VPN, or victim-side authentication evidence recovered |
Figure 7. fast_attack2.sh targeting FortiGate VPN, SharePoint, Kactus RL, and [REDACTED] OAuth
Figure 8. hits2.txt listing 98 FortiGate heuristic-match records; authentication was not independently confirmed
Credential Association and Limitations
One email address from each of all_results.csv and hits2.txt was cross-referenced with publicly available information and corroborated as being associated with Colombian government personnel.
This verification supports only the organizational association of the email addresses and does not validate the accompanying passwords or confirm successful authentication.
Figure 9. Publicly available Colombian government profile matching an email address found in all_results.csv
Figure 10. Publicly available Colombian government profile matching an email address found in hits2.txt
Evidence Basis and Confidence
This report is based on recovered attacker-side artifacts: shell history, Python and shell scripts, a candidate credential list, and attacker-generated result files. It does not rely on an independent rescan of the targets or victim-side telemetry.
| Assessment | Confidence | Basis |
|---|---|---|
| Solr exploitation was attempted | Moderate | Shell-history invocation and target-configured exploit tooling; no target response or victim logs |
| Credential testing was performed | High | Test scripts and corresponding response-classification files |
| Two email addresses were organizationally associated | High | Publicly available personnel records matched the addresses |
| SQL execution, data retrieval, or successful authentication occurred | Not established | No returned data, authenticated session, MFA, VPN, or victim-side evidence |
Precise activity and collection timestamps, time zones, source geolocation details, and hashes of the original recovered artifacts were not retained in the available publication record. These gaps limit temporal correlation and independent artifact verification.
Conclusion
Recovered shell history and Python tooling show an attempt to use CVE-2021-27905 to route a PostgreSQL-formatted SQL payload toward an internal service associated with a Mexican public-sector target. The artifacts establish invocation and intended behavior, but not successful request delivery, SSRF completion, SQL execution, or data retrieval.
Separately, shell scripts tested 243 candidate credential entries against Colombian public-sector login services. The resulting 98 FortiGate heuristic matches represented 57 unique credential pairs, but the classifications were based on response characteristics and did not confirm successful authentication.
The demonstrated impact is therefore limited to attempted Solr exploitation, confirmed credential-testing activity, and exposure of candidate credential pairs associated with public-sector personnel—not confirmed compromise of either the Mexican or Colombian organizations. Relevant organizations should review web and authentication logs for the described activity, update Apache Solr deployments older than 8.8.2, restrict unnecessary access to Solr administrative handlers, invalidate exposed passwords, and enforce phishing-resistant MFA where supported.