CVE-2022-24112 apisix/batch-requests plugin allows overwriting the X-REAL-IP header

🗓️ 11 Feb 2022 12:20:13Reported by GoogleType

osv

osv🔗 osv.dev👁 50 Views

An attacker can abuse batch-requests plugin to bypass Apache APISIX IP restriction and execute remote cod

Reporter	Title	Published	Views	Family All 40
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	25 Feb 202215:17	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	16 Mar 202209:19	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	17 Mar 202208:22	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	22 Feb 202214:09	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	20 Mar 202216:35	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	8 Mar 202217:08	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	3 Dec 202214:31	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Apache Apisix	23 May 202522:09	–	githubexploit
GithubExploit	Exploit for CVE-2022-244112	8 Mar 202217:08	–	githubexploit
0day.today	Apache APISIX Remote Code Execution Exploit	7 Mar 202200:00	–	zdt

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
packetstormsecurity	www.packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html
lists	www.lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24112.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-24112
openwall	www.openwall.com/lists/oss-security/2022/02/11/3

15 Jul 2026 01:49Current

7.7High risk

Vulners AI Score7.7

CVSS 3.19.8

EPSS0.96182

apache apisix batch-requests plugin ip restriction remote code execution cve-2022-24112 data panel