Solr suspicious behavior

Question

I've Sitecore instance hosted on Azure according to below breakdown :

1. Sitecore 9.1 (each component as standalone App Service)
2. Solr 7.2.1 (standalone App Service)
3. App insights configured and connected to all provisioned app services.

Suddenly Solr went down and became un available (Getting 503 ERROR)

I was investigating the issue on App Insights (reviewing requests, traces .. etc.) and found below requests are being triggered on SOLR App Service..

Every few minutes, there is a request to access random port on localhost !

Is it really SOLR doing that trials ? or kind of breaches or attacks ?

I'm not able to figure it out .. why this is happening on Solr instance ?

Answer 1

/solr/admin/info/system?wt=json is a well-known exploit that allows to get access to system information of a Solr instance. This is not a standard behaviour of Sitecore or Solr, so these requests must be sent by an external bot or script.

Consider enabling IP restriction for your Solr app service so that only known servers and locations can access it. You can do it for an app service via section Networking and Access restriction feature on the Azure portal.