CVE-2022-24112

Apache APISIX: Authentication Bypass

As of , CVE-2022-24112 in Apache APISIX is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 25 August 2022
US federal deadline
15 September 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.96Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.70 on 25 August 2022EPSS on the day CISA listed it.
Public exploit
1 Metasploit module and 1 Exploit-DB entry
Fix
Vendor advice: lists.apache.orgLinks below, from CISA's entry.

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.

CISA's description

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

The CVE record's description, from apache

CVE published
11 February 2022
Assigned by
apache
CVSS
9.8 Critical (CVSS 3.1, from CISA-ADP)
CWE-290
Authentication Bypass by Spoofing
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. Exploit-DB published an exploit (EDB-ID 50829).
  3. CISA added it to its list of exploited vulnerabilities.
  4. The US federal deadline to fix it.

Public exploits

Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.

Read further