Remote Code Execution in Apache APISIX due to Open Admin API Access

CVE-2020-13945

Summary

The vulnerability in Apache APISIX arises from the enabled Admin API and the removal of IP restriction rules, permitting the default token to access sensitive management data. This flaw can be exploited by malicious actors to gain unauthorized entry, potentially leading to remote code execution and manipulation of APISIX instances. Affected versions include 1.2 through 1.5, emphasizing the need for administrators to restrict access and take preventive measures to secure their APIs.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2020-13945
Created by Rapid7

CVE-2020-13945-EXPLOIT
Created by K3ysTr0K3R

References