Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.8
CVSSv3

CVE-2022-24112

Published: 11/02/2022 Updated: 11/05/2022
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 670
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Apache

Vulnerability Summary

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache apisix

Exploits

Exploit DB: Apache APISIX 2.12.1 Remote Code Execution
Apache APISIX version 2121 suffers from a remote code execution vulnerability ...
Exploit DB: Apache APISIX Remote Code Execution
Apache APISIX has a default, built-in API token that can be used to obtain full access of the admin API Access to this API allows for remote LUA code execution through the script parameter added in the 2x version This module also leverages another vulnerability to bypass th e IP restriction plugin ...

Mailing Lists

Full Disclosure: CVE-2022-24112: Apache APISIX: apisix/batch-requests plugin allows overwriting the X-REAL-IP header
<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> CVE-2022-24112: Apache APISIX: apisix/batch-requests plugin allows overwriting the X-REAL-IP header <!--X-Subject-Header-End-- ...

Github Repositories

https://github.com/Greetdawn/Apache-APISIX-dashboard-RCE

Apache APISIX简介 Apache APISIX 是一个动态、实时、高性能的 API 网关， 提供负载均衡、动态上游、灰度发布、服务熔断、身份认证、可观测性等丰富的流量管理功能。Apache APISIX Dashboard 使用户可通过前端界面操作 Apache APISIX。 安全申明 本博客主要用于学习记录相关安全事件和漏洞文章，供

https://github.com/Udyz/CVE-2022-24112

Apache APISIX apisix/batch-requests RCE

CVE-2022-24112 Apache APISIX apisix/batch-requests RCE

https://github.com/M4xSec/Apache-APISIX-CVE-2022-24112

Apache APISIX Remote Code Execution (CVE-2022-24112) proof of concept exploit

Apache APISIX Remote Code Execution (CVE-2022-24112) Exploit Summary An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution When the admin key was changed or the port of Admin API was changed to a port different from the da

https://github.com/Axx8/CVE-2022-24112

Apache APISIX batch-requests RCE(CVE-2022-24112)

CVE-2022-24112 Apache APISIX batch-requests RCE(CVE-2022-24112) 将目标放入urltxt python3 Apache_APISIX_RCE(CVE-2022-24112)py Cmd: &lt;command&gt;

https://github.com/Acczdy/CVE-2022-24112_POC

CVE-2022-24112_POC

POC 收集的POC CVE-2022-24112 为了做春秋云境:CVE-2022-24112靶场环境，修改了两个POC，将M4xSec与twseptian两位师傅的POC稍作修改，适应春秋云境靶场： 春秋云境:CVE-2022-24112： Apache Apisix是美国阿帕奇（Apache）基金会的一个云原生的微服务API网关服务。该软件基于 OpenResty 和 etcd 来实现，具备动态路

https://github.com/Acczdy/POC

CVE-2022-24112_POC

POC 收集的POC CVE-2022-24112 为了做春秋云境:CVE-2022-24112靶场环境，修改了两个POC，将M4xSec与twseptian两位师傅的POC稍作修改，适应春秋云境靶场： 春秋云境:CVE-2022-24112： Apache Apisix是美国阿帕奇（Apache）基金会的一个云原生的微服务API网关服务。该软件基于 OpenResty 和 etcd 来实现，具备动态路

https://github.com/Mah1ndra/CVE-2022-244112

CVE-2022-24112: Apache APISIX Remote Code Execution Vulnerability

CVE-2022-24112: Apache APISIX Remote Code Execution Vulnerability go run apisix-exploitgo -t &lt;target&gt; -c &lt;command&gt; Reference: nvdnistgov/vuln/detail/CVE-2022-24112 listsapacheorg/thread/dzmgf0bwfmt58rfbz611gqo2b56qyqwq

https://github.com/Mah1ndra/CVE-2022-24112

CVE-2022-24112: Apache APISIX Remote Code Execution Vulnerability

CVE-2022-24112: Apache APISIX Remote Code Execution Vulnerability go run apisix-exploitgo -t &lt;target&gt; -c &lt;command&gt; Reference: nvdnistgov/vuln/detail/CVE-2022-24112 listsapacheorg/thread/dzmgf0bwfmt58rfbz611gqo2b56qyqwq

https://github.com/twseptian/cve-2022-24112

Apache APISIX < 2.12.1 Remote Code Execution and Docker Lab

Apache APISIX &lt; 2121 Remote Code Execution and Docker Lab Let's clone using gitclone this repository, then we can navigate to apisix-docker/examples In this docker-composeyml file, we already change into image: apache/apisix:2120-alpine, because the vulnerability in this version, then let's install using docker compose QuickStart via docker-compose,we ca

https://github.com/kavishkagihan/CVE-2022-24112-POC

Apache APISIX 2.12.1 Remote Code Execution by IP restriction bypass and using default admin AIP token

CVE-2022-24112-POC Apache APISIX 2121 Remote Code Execution by IP restriction bypass and using default admin AIP token Full walkthrough kavigihanmediumcom/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff

https://github.com/Mr-xn/CVE-2022-24112

CVE-2022-24112：Apache APISIX apisix/batch-requests RCE

CVE-2022-24112 CVE-2022-24112：Apache APISIX apisix/batch-requests RCE nuclei template ：CVE-2022-24112yaml 这个漏洞本质利用和 CVE-2021-45232 类似，都是绕过授权或未授权，来执行恶意的 route 里的 filter_func 或者 script 来执行命令 注意是事项 X-Real-IP 的值可以是 127001,localhost 或者 2130706433 pipeline 是必须项，以

References

CWE-290https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94http://www.openwall.com/lists/oss-security/2022/02/11/3http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.htmlhttps://nvd.nist.govhttps://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.htmlhttps://github.com/Udyz/CVE-2022-24112
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-30924CVE-2024-3400overflowCVE-2024-23528CVE-2024-21338CVE-2024-3818CVE-2024-23535NULL pointer dereferenceelevation of privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook