{"containers": {"cna": {"affected": [{"product": "Apache APISIX", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.12.1", "status": "affected", "version": "Apache APISIX 2.12", "versionType": "custom"}, {"lessThan": "2.10.4", "status": "affected", "version": "Apache APISIX 2.10", "versionType": "custom"}, {"lessThan": "Apache APISIX 1*", "status": "affected", "version": "1.3", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Original discovery by Real World CTF at Chaitin Tech. Reported by Sauercloud."}], "descriptions": [{"lang": "en", "value": "An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed."}], "metrics": [{"other": {"content": {"other": "high"}, "type": "unknown"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-03-16T18:06:16", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94"}, {"name": "[oss-security] 20220211 CVE-2022-24112: Apache APISIX: apisix/batch-requests plugin allows overwriting the X-REAL-IP header", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2022/02/11/3"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html"}], "source": {"discovery": "UNKNOWN"}, "title": "apisix/batch-requests plugin allows overwriting the X-REAL-IP header", "workarounds": [{"lang": "en", "value": "1. explicitly configure the enabled plugins in `conf/config.yaml`, ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`)\nOr\n1. upgrade to 2.10.4 or 2.12.1."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2022-24112", "STATE": "PUBLIC", "TITLE": "apisix/batch-requests plugin allows overwriting the X-REAL-IP header"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache APISIX", "version": {"version_data": [{"version_affected": "<", "version_name": "Apache APISIX 2.12", "version_value": "2.12.1"}, {"version_affected": "<", "version_name": "Apache APISIX 2.10", "version_value": "2.10.4"}, {"version_affected": ">=", "version_name": "Apache APISIX 1", "version_value": "1.3"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "credit": [{"lang": "eng", "value": "Original discovery by Real World CTF at Chaitin Tech. Reported by Sauercloud."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": [{"other": "high"}], "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-290 Authentication Bypass by Spoofing"}]}]}, "references": {"reference_data": [{"name": "https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94", "refsource": "MISC", "url": "https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94"}, {"name": "[oss-security] 20220211 CVE-2022-24112: Apache APISIX: apisix/batch-requests plugin allows overwriting the X-REAL-IP header", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2022/02/11/3"}, {"name": "http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html"}, {"name": "http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html"}]}, "source": {"discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "1. explicitly configure the enabled plugins in `conf/config.yaml`, ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`)\nOr\n1. upgrade to 2.10.4 or 2.12.1."}]}}}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2022-24112", "datePublished": "2022-02-11T12:20:13", "dateReserved": "2022-01-28T00:00:00", "dateUpdated": "2022-03-16T18:06:16", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"cisaActionDue": "2022-09-15", "cisaExploitAdd": "2022-08-25", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Apache APISIX Authentication Bypass Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA41EFA2-1D6E-4D57-89BC-F8A96D684F23", "versionEndExcluding": "2.10.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*", "matchCriteriaId": "8F0B2998-1638-42BC-8585-9AF1E137F4CF", "versionEndExcluding": "2.12.1", "versionStartIncluding": "2.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed."}, {"lang": "es", "value": "Un atacante puede abusar del plugin batch-requests para enviar peticiones para omitir la restricci\u00f3n de IP de la API de administraci\u00f3n. Una configuraci\u00f3n por defecto de Apache APISIX (con la clave API por defecto) es vulnerable a una ejecuci\u00f3n de c\u00f3digo remota. Cuando ha sido cambiada la clave de administraci\u00f3n o ha sido cambiado el puerto de la API de administraci\u00f3n a un puerto diferente al del panel de datos, el impacto es menor. Pero todav\u00eda se presenta el riesgo de omitir la restricci\u00f3n de IP del panel de datos de Apache APISIX. Se presenta una comprobaci\u00f3n en el plugin de peticiones por lotes que anula la IP del cliente con su IP remota real. Pero debido a un error en el c\u00f3digo, esta comprobaci\u00f3n puede ser omitida"}], "id": "CVE-2022-24112", "lastModified": "2022-05-11T14:58:01.343", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-02-11T13:15:08.073", "references": [{"source": "security@apache.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html"}, {"source": "security@apache.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html"}, {"source": "security@apache.org", "tags": ["Mailing List", "Mitigation", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/02/11/3"}, {"source": "security@apache.org", "tags": ["Mailing List", "Mitigation", "Vendor Advisory"], "url": "https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-290"}], "source": "security@apache.org", "type": "Secondary"}]}

{}