CVE-2021-45232-RCE

Apache APISIX Dashboard RCE использование: -h -u URL -p PORT -c CMD необязательные аргументы: -h, --help показать это справочное сообщение и выйти -u URL, --url URL целевой URL например: http://127.0.0.1:9000 -p PORT, --port PORT порт управления apisix по умолчанию: 9080 -c CMD, --cmd CMD команда...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 Удаленное выполнение кода путем обхода ограничения по IP и использования токена администратора AIP по умолчанию Полное руководство https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

CVE-2022-24112

CVE-2022-24112 CVE-2022-24112: Apache APISIX apisix/batch-requests RCE nuclei template: CVE-2022-24112.yaml Эта уязвимость по своей сути аналогична CVE-2021-45232 — обе обходят авторизацию или работают без неё, чтобы выполнить вредоносный код через filterfunc или script в маршруте route. Примечан...

CVE-2022-24112

CVE-2022-24112 Apache APISIX batch-requests RCE CVE-2022-24112 Mettez la cible dans url.txt python3 ApacheAPISIXRCECVE-2022-24112.py Cmd:...

CVE-2021-45232-RCE

CVE-2021-45232 CVE-2021-45232 Apache APISIX Dashboard API RCE sans authentification Version : 2.10.1 Fofa : titre="Apache APISIX Dashboard" POC : IP:PORT/apisix/admin/migrate/export...

CVE-2021-45232

CVE-2021-45232 CVE-2021-45232 POC 1. Scan de la vulnérabilité d'accès non autorisé à l'interface Apache APISIX Dashboard CVE-2021-45232 2. Scan des mots de passe par défaut d'Apache APISIX Dashboard...

CVE-2021-45232

Vulnérabilité d'accès non autorisé d'Apache APISIX Dashboard CVE-2021-45232 Recherche FOFA title="Apache APISIX Dashboard" Périmètre affecté Apache APISIX Dashboard 2.10.1 POC : IP:PORT/apisix/admin/migrate/export IP:PORT/apisix/admin/migrate/export Recommandations de correction Mettre à niveau...

CVE-2022-24112

Exploitation d'exécution de code à distance RCE Apache APISIX 2.12.x Ce script Python est une preuve de concept PoC pour une vulnérabilité d'exécution de code à distance RCE dans les versions 2.12.0 et 2.12.1 d'Apache APISIX. La vulnérabilité réside dans l'utilisation abusive du champ Lua...

CVE-2021-45232

Apache APISIX Dashboard 未授权访问接口 说明 该工具集成了 fofa 和 poc 一键检测功能，实现了一键从 fofa 爬取和一键检测（边爬边测） 使用方法 使用版本（Version）：python3 测试前要先更改自己的 fofatoken 值与更改变量 fofa 语法自定义测试范围 image-20220108153856024 python3 CVE-2021-45232.py 3 1 image-20220108153151252 image-20220108153428170 结果会保存在 resualt.txt 中...

CVE-2026-31908

CVE-2026-31908 — Эксплойт внедрения заголовков в Apache APISIX 📋 Обзор Это Proof of Concept PoC эксплойт для CVE-2026-31908 — критической уязвимости внедрения заголовков, обнаруженной в Apache APISIX версий 2.12.0 — 3.15.0. Уязвимость существует в плагине forward-auth, где некорректная санитизаци...

CVE-2021-45232-RCE

CVE-2021-45232-RCE CVE-2021-45232-RCE — многопоточное массовое обнаружение уязвимостей Запрос FOFA title="Apache APISIX Dashboard" Затронутые версии Apache APISIX Dashboard 2.10.1 POC: IP:PORT/apisix/admin/migrate/export Если это было полезно, пожалуйста, поставьте звёздочку, спасибо! Массовое...

CVE-2022-24112

CVE-2022-24112 Apache APISIX apisix/batch-requests RCE...

k8s-CVE-2021-43557-poc

Установка установите minikube установите apisix: helm repo add apisix https://charts.apiseven.com helm repo add bitnami https://charts.bitnami.com/bitnami helm repo update kubectl create ns ingress-apisix helm install apisix apisix/apisix \ --set gateway.type=NodePort \ --set...

cve-2022-24112

Apache APISIX 2.12.1 Exécution de code à distance et laboratoire Docker Clonons ce dépôt en utilisant gitclone, puis nous pouvons naviguer vers apisix-docker/examples. Dans ce fichier docker-compose.yml, nous avons déjà remplacé l'image par image: apache/apisix:2.12.0-alpine, car la vulnérabilité...

CVE-2026-94269

Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that...

CVE-2026-94250

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...

CVE-2026-94276

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-94212

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

CVE-2026-94220

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-82806

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...