CVE-2022-24112 apisix/batch-requests plugin allows overwriting the X-REAL-IP header

2022-02-1112:20:13

CWE-290

apache

www.cve.org

9.9 High

AI Score

Confidence

High

0.974 High

EPSS

Percentile

99.9%

JSON

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX’s data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

CNA Affected

[
  {
    "product": "Apache APISIX",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.12.1",
        "status": "affected",
        "version": "Apache APISIX 2.12",
        "versionType": "custom"
      },
      {
        "lessThan": "2.10.4",
        "status": "affected",
        "version": "Apache APISIX 2.10",
        "versionType": "custom"
      },
      {
        "lessThan": "Apache APISIX 1*",
        "status": "affected",
        "version": "1.3",
        "versionType": "custom"
      }
    ]
  }
]