280 matches found
Apache APISIX Remote Code Execution (CVE-2022-24112)
A remote code execution vulnerability exists in Apache APISIX. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system...
Apache Apisix Input Validation Error Vulnerability
Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd, with dynamic routing and plugin hot-loading for API management in microservices systems. An attacker could use this vulnerability to bypass the bodyschema...
CVE-2022-25757
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the bodyschema validation in the request-validation plugin. For example,...
CVE-2022-25757
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the bodyschema validation in the request-validation plugin. For example,...
Input validation
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the bodyschema validation in the request-validation plugin. For example,...
CVE-2022-25757 Apache APISIX: the body_schema check in request-validation plugin can be bypassed
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the bodyschema validation in the request-validation plugin. For example,...
CVE-2022-25757 Apache APISIX: the body_schema check in request-validation plugin can be bypassed
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the bodyschema validation in the request-validation plugin. For example,...
Apache Apisix 输入验证错误漏洞
Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd, with dynamic routing and plugin hot-loading for API management in microservices systems. An attacker could use this vulnerability to bypass the bodyschema...
PT-2022-17492 · Apache · Apache Apisix
Name of the Vulnerable Software and Affected Versions: Apache APISIX versions prior to 2.13.0 Description: The issue allows an attacker to bypass body schema validation in the request-validation plugin by passing a JSON with a duplicate key. This can be achieved by sending a JSON payload such as...
Exploit for Authentication Bypass by Spoofing in Apache Apisix
Apache APISIX Apache APISIX 2.12.1 - Remote Code Execution...
Exploit for Authentication Bypass by Spoofing in Apache Apisix
CVE-2022-24112-POC Apache APISIX 2.12.1 Rem...
Exploit for Authentication Bypass by Spoofing in Apache Apisix
Apache APISIX Remote Code Execution CVE-2022-24112 Exploit...
Apache APISIX 2.12.1 Remote Code Execution
Exploit Title: Apache APISIX 2.12.1 - Remote Code Execution RCE Date: 2022-03-16 Exploit Author: Ven3xy Vendor Homepage: https://apisix.apache.org/ Version: Apache APISIX 1.3 – 2.12.1 Tested on: CentOS 7 CVE : CVE-2022-24112 import requests import sys class color: HEADER = '\03395m' IMPORTANT =...
Apache APISIX 2.12.1 - Remote Code Execution Exploit
Exploit Title: Apache APISIX 2.12.1 - Remote Code Execution RCE Exploit Author: Ven3xy Vendor Homepage: https://apisix.apache.org/ Version: Apache APISIX 1.3 – 2.12.1 Tested on: CentOS 7 CVE : CVE-2022-24112 import requests import sys class color: HEADER = '\03395m' IMPORTANT = '\3335m' NOTICE =...
Apache APISIX 2.12.1 - Remote Code Execution (RCE)
Exploit Title: Apache APISIX 2.12.1 - Remote Code Execution RCE Date: 2022-03-16 Exploit Author: Ven3xy Vendor Homepage: https://apisix.apache.org/ Version: Apache APISIX 1.3 – 2.12.1 Tested on: CentOS 7 CVE : CVE-2022-24112 import requests import sys class color: HEADER = '\03395m' IMPORTANT =...
Exploit for Authentication Bypass by Spoofing in Apache Apisix
CVE-2022-24112: Apache APISIX Remote Code Ex...
Exploit for CVE-2022-244112
CVE-2022-24112: Apache APISIX Remote Code Ex...
Apache APISIX Remote Code Execution Exploit
Apache APISIX has a default, built-in API token that can be used to obtain full access of the admin API. Access to this API allows for remote LUA code execution through the script parameter added in the 2.x version. This module also leverages another vulnerability to bypass th e IP restriction...