CVE-2021-43557: Path traversal in request_uri variable
The uri-block plugin in Apache APISIX before 2.10.2 uses $requesturi without verification. The $requesturi is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like //internal/ can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-43557?
CVE-2021-43557 is a vulnerability in Apache APISIX before version 2.10.2 that allows bypassing the block list using an unverified $request_uri.
How severe is CVE-2021-43557?
CVE-2021-43557 has a severity rating of 7.5 (High).
Which software versions are affected by CVE-2021-43557?
Apache APISIX versions up to and excluding 2.10.2 are affected by CVE-2021-43557.
How can I fix CVE-2021-43557?
To fix CVE-2021-43557, upgrade Apache APISIX to version 2.10.2 or later.
What is the CWE ID for CVE-2021-43557?
The CWE ID for CVE-2021-43557 is CWE-77.