Vulnerability · Published Nov 22, 2021 · Assigned by apache

CVE-2021-43557Path traversal in request_uri variable

High 7.5

In plain English

A high-severity security flaw in Apache APISIX from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 13.0% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)13.0%top 3.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache APISIX	1.5 – before Apache APISIX 1.5*

References

https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h x_refsource_MISC
[oss-security] 20211122 CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable mailing-list, x_refsource_MLIST
[oss-security] 20211122 Re: CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable mailing-list, x_refsource_MLIST
[oss-security] 20211123 Re: CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable mailing-list, x_refsource_MLIST