apisix/batch-requests plugin allows overwriting the X-REAL-IP header
CVE-2022-24112

9.8CRITICAL

Key Information:

Vendor: Apache
Status: Apache Apisix
Vendor: CVE Published:; 11 February 2022

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 97%🦅 CISA Reported

Summary

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Apache APISIX Apache APISIX 2.12 < 2.12.1

Apache APISIX Apache APISIX 2.10 < 2.10.4

Apache APISIX 1.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-24112
Created by Mr-xn

Apache-APISIX-CVE-2022-24112
Created by M4xSec

CVE-2022-24112
Created by Axx8