CVE-2022-24112: Apache APISIX Authentication Bypass Vulnerability
First published: Fri Feb 11 2022(Updated: )
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache APISIX | <2.10.4 | |
| Apache APISIX | >=2.11.0<2.12.1 | |
| Apache APISIX | ||
| <2.10.4 | ||
| >=2.11.0<2.12.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2022/02/11/3
- https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94
- https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94;
- https://nvd.nist.gov/vuln/detail/CVE-2022-24112
Frequently Asked Questions
What is the vulnerability ID for the Apache APISIX Authentication Bypass Vulnerability?
The vulnerability ID for the Apache APISIX Authentication Bypass Vulnerability is CVE-2022-24112.
What is the severity of CVE-2022-24112?
The severity of CVE-2022-24112 is critical with a CVSS score of 9.8.
How can an attacker exploit CVE-2022-24112?
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API, leading to remote code execution.
Which software is affected by CVE-2022-24112?
Apache APISIX versions up to 2.10.4 and versions between 2.11.0 and 2.12.1 are affected by CVE-2022-24112.
Are there any references for CVE-2022-24112?
Yes, you can find references for CVE-2022-24112 at the following links: [Link 1](https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94), [Link 2](http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html), [Link 3](http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html)
- collector/nvd-index
- agent/type
- agent/description
- agent/severity
- agent/title
- agent/author
- agent/weakness
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/tags
- collector/nvd-cve
- source/NVD
- vendor/apache
- canonical/apache apisix
- version/apache apisix/2.11.0