CVE-2022-24112

CVE-2022-24112: Vulnerabilidade de Execução Remota de Código no Apache APISIX root@kitploit: go run apisix-exploit.go -t -c Referência: https://nvd.nist.gov/vuln/detail/CVE-2022-24112 https://lists.apache.org/thread/dzmgf0bwfmt58rfbz611gqo2b56qyqwq...

CVE-2022-24112

CVE-2022-24112 CVE-2022-24112: Apache APISIX apisix/batch-requests RCE nuclei template: CVE-2022-24112.yaml Эта уязвимость по своей сути аналогична CVE-2021-45232 — обе обходят авторизацию или работают без неё, чтобы выполнить вредоносный код через filterfunc или script в маршруте route. Примечан...

CVE-2021-45232-RCE

CVE-2021-45232 CVE-2021-45232 Apache APISIX Dashboard API unberechtigter RCE Version: 2.10.1 Fofa: Titel="Apache APISIX Dashboard" PoC: root@kitploit: IP:PORT/apisix/admin/migrate/export...

CVE-2022-24112

Apache APISIX 2.12.x - Exploit di Esecuzione Remota di Codice RCE Questo script Python è una Proof-of-Concept PoC per una vulnerabilità di esecuzione remota di codice RCE in Apache APISIX versioni 2.12.0 e 2.12.1. La vulnerabilità risiede nell'uso improprio del campo Lua filterfunc all'interno...

CVE-2021-45232

CVE-2021-45232 CVE-2021-45232 POC 1、Scan für die nicht autorisierte Zugriffsschwachstelle der Apache APISIX Dashboard-Schnittstelle CVE-2021-45232 2、Scan für Standardkennwörter des Apache APISIX Dashboards...

CVE-2026-63041

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

EUVD-2026-66409

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

CVE-2026-63041

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

CVE-2026-63041 Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...

CVE-2022-24112_POC

POC POC raccolti CVE-2022-24112 Per l'ambiente del campo di tiro 春秋云境:CVE-2022-24112, ho modificato due POC, modificando leggermente i POC dei due autori M4xSec e twseptian per adattarli al campo di tiro 春秋云境: 春秋云境:CVE-2022-24112: Apache Apisix è un gateway API cloud-native per microservizi della...

cve-2022-24112

Apache APISIX 2.12.1 Esecuzione di codice remoto e laboratorio Docker Facciamo il clone di questo repository usando gitclone, quindi possiamo navigare in apisix-docker/examples. In questo file docker-compose.yml, abbiamo già cambiato in image: apache/apisix:2.12.0-alpine, perché la vulnerabilità ...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 में IP प्रतिबंध बायपास और डिफ़ॉल्ट एडमिन AIP टोकन का उपयोग करके रिमोट कोड निष्पादन RCE पूर्ण वॉकथ्रू https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

CVE-2026-49230-APISIX-jwe-decrypt-Auth-Bypass

CVE-2026-49230 — Contournement d'authentification dans Apache APISIX jwe-decrypt Preuve de concept d'un contournement d'authentification dans le plugin Apache APISIX jwe-decrypt. Ce plugin déchiffre un jeton JWE et transmet son texte clair à l'amont, agissant comme une porte d'authentification —...

CVE-2020-13945-EXPLOIT

CVE-2020-13945 - Apache APISIX Remote Code Execution RCE Questo repository contiene un proof-of-concept PoC per una vulnerabilità in Apache APISIX. La vulnerabilità si presenta quando l'Admin API è abilitata e le regole di restrizione degli IP di accesso vengono eliminate, consentendo al token...

Apache-APISIX-CVE-2022-24112

Exploit dell'esecuzione di codice remota di Apache APISIX CVE-2022-24112 Riepilogo Un attaccante può abusare del plugin batch-requests per inviare richieste al fine di aggirare la restrizione IP dell'Admin API. Una configurazione predefinita di Apache APISIX con chiave API predefinita è vulnerabi...

westone-CVE-2021-45232-scanner

westone-CVE-2021-45232-scanner Apache APISIX Dashboard versioni precedenti 2.10.1 presentano una vulnerabilità di sicurezza relativa all'accesso non autorizzato. La Manager API utilizza due framework e introduce il framework droplet sulla base del framework gin; tutte le API e i middleware di...

BIT-APISIX-2026-49872 Apache APISIX: Improper authentication in cas-auth plugin

Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credentials from a different source. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version...

BIT-APISIX-2026-49871 Apache APISIX: cas-auth login CSRF / session injection issue

Cross-Site Request Forgery CSRF vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim's browser to become authenticated as a different identity. Actions the victim...

BIT-APISIX-2026-49231 Apache APISIX: Identity spoofing issue in APISIX opa plugin

Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay spoofed identity headers to upstream capitalising on non-default configuration in opa plugin. This could allow the attacker to assume higher privileges on the upstream service. This issue affects Apache APISIX:...