CVE-2022-24112

🗓️ 11 Feb 2022 12:20:13Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 1102 Views🌐 WEB

CVE-2022-24112: Apache APISIX batch-requests plugin vulnerabilit

Reporter	Title	Published	Views	Family All 39
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	25 Feb 202215:17	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	16 Mar 202209:19	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	17 Mar 202208:22	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	22 Feb 202214:09	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	20 Mar 202216:35	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	8 Mar 202217:08	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	3 Dec 202214:31	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	23 May 202522:09	–	githubexploit
GithubExploit	Exploit for CVE-2022-244112	8 Mar 202217:08	–	githubexploit
zdt	Apache APISIX Remote Code Execution Exploit	7 Mar 202200:00	–	zdt

NVD

Vulners

Node

apache apisixRange<2.10.4

apache apisixRange2.11.0–2.12.1

[
  {
    "product": "Apache APISIX",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.12.1",
        "status": "affected",
        "version": "Apache APISIX 2.12",
        "versionType": "custom"
      },
      {
        "lessThan": "2.10.4",
        "status": "affected",
        "version": "Apache APISIX 2.10",
        "versionType": "custom"
      },
      {
        "lessThan": "Apache APISIX 1*",
        "status": "affected",
        "version": "1.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2022/02/11/3
packetstormsecurity	www.packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
packetstormsecurity	www.packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html
lists	www.lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
pipeline[0].body	request body	apisix/batch-requests	Exploit uses batch-requests to override client IP and execute a remote command via a crafted pipeline payload (RCE).	CWE-290
pipeline[0].path	request body	apisix/batch-requests	Exploit uses batch-requests to override client IP and execute a remote command via a crafted pipeline payload (RCE).	CWE-290
pipeline[0].method	request body	apisix/batch-requests	Exploit uses batch-requests to override client IP and execute a remote command via a crafted pipeline payload (RCE).	CWE-290
timeout	request body	apisix/batch-requests	Exploit uses batch-requests to override client IP and execute a remote command via a crafted pipeline payload (RCE).	CWE-290
uri	path	apisix/admin/routes/index	Target of the exploited pipeline where a forged route is created as part of the RCE payload.	CWE-290
upstream	path	apisix/admin/routes/index	Target of the exploited pipeline where a forged route is created as part of the RCE payload.	CWE-290
name	path	apisix/admin/routes/index	Target of the exploited pipeline where a forged route is created as part of the RCE payload.	CWE-290
filter_func	path	apisix/admin/routes/index	Target of the exploited pipeline where a forged route is created as part of the RCE payload.	CWE-290

17 Jun 2026 04:31Current

9.7High risk

Vulners AI Score9.7

CVSS 27.5

CVSS 3.19.8

EPSS0.96001

SSVC