CVE-2022-25757: Apache APISIX: the body_schema check in request-validation plugin can be bypassed
First published: Mon Mar 28 2022(Updated: )
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the body_schema validation in the request-validation plugin. For example, `{"string_payload":"bad","string_payload":"good"}` can be used to hide the "bad" input. Systems satisfy three conditions below are affected by this attack: 1. use body_schema validation in the request-validation plugin 2. upstream application uses a special JSON library that chooses the first occurred value, like jsoniter or gojay 3. upstream application does not validate the input anymore. The fix in APISIX is to re-encode the validated JSON input back into the request body at the side of APISIX. Improper Input Validation vulnerability in __COMPONENT__ of Apache APISIX allows an attacker to __IMPACT__. This issue affects Apache APISIX Apache APISIX version 2.12.1 and prior versions.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache APISIX | <2.13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-25757?
CVE-2022-25757 is a vulnerability in Apache APISIX before version 2.13.0 that allows an attacker to bypass the body_schema validation in the request-validation plugin.
What is the severity of CVE-2022-25757?
CVE-2022-25757 has a severity rating of 9.8, which is considered critical.
How is Apache APISIX before version 2.13.0 affected by CVE-2022-25757?
Apache APISIX before version 2.13.0 is affected by CVE-2022-25757, allowing an attacker to bypass the body_schema validation in the request-validation plugin.
How can an attacker exploit CVE-2022-25757?
An attacker can exploit CVE-2022-25757 by passing a JSON with duplicate keys, which lua-cjson will choose the last occurred value as the result, bypassing the body_schema validation.
Is there a fix for CVE-2022-25757?
Yes, upgrading to Apache APISIX version 2.13.0 or later will fix CVE-2022-25757.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/author
- agent/title
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/apache
- canonical/apache apisix