QID 730361

Date Published: 2022-02-28

QID 730361: Apache Apisix Batch-Requests Plugin Remote Code Execution (RCE) Vulnerability

Apache APISIX is a dynamic, real-time, high-performance API gateway. APISIX provides rich traffic management features such as load balancing, dynamic upstream, canary release, circuit breaking, authentication, observability, and more.

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel.

Affected Versions:
Apache APISIX Prior to 2.12.1

QID Detection Logic(unauthenticated): This QID checks for vulnerable Apache Apisix versions by sending a payload to the Apisix Server

Successful exploitation of the vulnerability may allow remote code execution and complete system compromise

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

Vendor has release patch, for more information please refer to Apache AdvisoryWorkaround:
explicitly configure the enabled plugins in `conf/config.yaml`,ensure `batch-requests` is disabled.

Vendor References

Apache Apisix batch requests - lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94

CVEs related to QID 730361

CVE-2022-24112 |

Software Advisories

Advisory ID	Software	Component	Link
NA			apisix.apache.org/downloads/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].