QID 730323

Date Published: 2022-01-05

QID 730323: Apache Apisix Remote Code Execution (RCE) Vulnerability

Apache APISIX is a dynamic, real-time, high-performance API gateway. APISIX provides rich traffic management features such as load balancing, dynamic upstream, canary release, circuit breaking, authentication, observability, and more.

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework "gin", all APIs and authentication middleware are developed based on framework "droplet", but some API directly use the interface of framework "gin" thus bypassing the authentication.

Affected Versions:
Apache APISIX Dashboard before 2.10.1

QID Detection Logic(unauthenticated): This QID checks for vulnerable Apache Apisix versions by sending a payload to the Apisix Dashboard Server

Successful exploitation of the vulnerability may allow remote code execution and complete system compromise

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

Vendor has release patch, for more information please refer to Apache Advisory

Vendor References

Apache Apisix Security Advisory - lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5

CVEs related to QID 730323

CVE-2021-45232 |

Software Advisories

Advisory ID	Software	Component	Link
NA			apisix.apache.org/downloads/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].