{ "containers": { "cna": { "affected": [ { "product": "Apache APISIX", "vendor": "Apache Software Foundation", "versions": [ { "lessThan": "2.12.1", "status": "affected", "version": "Apache APISIX 2.12", "versionType": "custom" }, { "lessThan": "2.10.4", "status": "affected", "version": "Apache APISIX 2.10", "versionType": "custom" }, { "lessThan": "Apache APISIX 1*", "status": "affected", "version": "1.3", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "value": "Original discovery by Real World CTF at Chaitin Tech. Reported by Sauercloud." } ], "descriptions": [ { "lang": "en", "value": "An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed." } ], "metrics": [ { "other": { "content": { "other": "high" }, "type": "unknown" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-03-16T18:06:16", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94" }, { "name": "[oss-security] 20220211 CVE-2022-24112: Apache APISIX: apisix/batch-requests plugin allows overwriting the X-REAL-IP header", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2022/02/11/3" }, { "tags": [ "x_refsource_MISC" ], "url": "http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html" }, { "tags": [ "x_refsource_MISC" ], "url": "http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html" } ], "source": { "discovery": "UNKNOWN" }, "title": "apisix/batch-requests plugin allows overwriting the X-REAL-IP header", "workarounds": [ { "lang": "en", "value": "1. explicitly configure the enabled plugins in `conf/config.yaml`, ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`)\nOr\n1. upgrade to 2.10.4 or 2.12.1." } ], "x_generator": { "engine": "Vulnogram 0.0.9" }, "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@apache.org", "ID": "CVE-2022-24112", "STATE": "PUBLIC", "TITLE": "apisix/batch-requests plugin allows overwriting the X-REAL-IP header" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Apache APISIX", "version": { "version_data": [ { "version_affected": "<", "version_name": "Apache APISIX 2.12", "version_value": "2.12.1" }, { "version_affected": "<", "version_name": "Apache APISIX 2.10", "version_value": "2.10.4" }, { "version_affected": ">=", "version_name": "Apache APISIX 1", "version_value": "1.3" } ] } } ] }, "vendor_name": "Apache Software Foundation" } ] } }, "credit": [ { "lang": "eng", "value": "Original discovery by Real World CTF at Chaitin Tech. Reported by Sauercloud." } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed." } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, "impact": [ { "other": "high" } ], "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-290 Authentication Bypass by Spoofing" } ] } ] }, "references": { "reference_data": [ { "name": "https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94", "refsource": "MISC", "url": "https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94" }, { "name": "[oss-security] 20220211 CVE-2022-24112: Apache APISIX: apisix/batch-requests plugin allows overwriting the X-REAL-IP header", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2022/02/11/3" }, { "name": "http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html" }, { "name": "http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html" } ] }, "source": { "discovery": "UNKNOWN" }, "work_around": [ { "lang": "en", "value": "1. explicitly configure the enabled plugins in `conf/config.yaml`, ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`)\nOr\n1. upgrade to 2.10.4 or 2.12.1." } ] } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:59:23.660Z" }, "title": "CVE Program Container", "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94" }, { "name": "[oss-security] 20220211 CVE-2022-24112: Apache APISIX: apisix/batch-requests plugin allows overwriting the X-REAL-IP header", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2022/02/11/3" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html" } ] } ] }, "cveMetadata": { "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2022-24112", "datePublished": "2022-02-11T12:20:13", "dateReserved": "2022-01-28T00:00:00", "dateUpdated": "2024-08-03T03:59:23.660Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }