Log in Start free

Actively exploited · Published Feb 11, 2022 · Assigned by apache

CVE-2022-24112apisix/batch-requests plugin allows overwriting the X-REAL-IP header

Critical 9.8 Exploited

In plain English

A critical-severity authentication bypass by spoofing in Apache APISIX from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on August 25, 2022). The chance it is exploited in the next 30 days is estimated at 96.1% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)96.1%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Aug 25, 2022
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Sep 15, 2022.

Official description

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache APISIX Apache APISIX 2.12 – before 2.12.1Apache APISIX 2.10 – before 2.10.41.3 – before Apache APISIX 1*

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References