Exploit for Authentication Bypass by Spoofing in Apache Apisix

POCs Collected POCs CVE-2022-24112 To create a test...

Apache APISIX Authentication Bypass Vulnerability

Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution...

VulnCheck KEV: CVE-2022-24112

Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution...

Apache APISIX < 2.13.0 Input Validation

The version of Apache APISIX installed on the remote host is prior to 2.13.0. It is, therefore, potentially affected by an input validation vulnerability. When decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, t...

Apache APISIX Dashboard 2.6 < 2.6.1 Authentication Bypass

The version of Apache APISIX Dashboard installed on the remote host is 2.6 prior to 2.6.1. It is, therefore, affected by an authentication bypass vulnerability. In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure...

Apache APISIX < 2.13.1 Information Disclosure

The version of Apache APISIX installed on the remote host is prior to 2.13.1. It is, therefore, potentially affected by an information disclosure vulnerability because the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency...

The vulnerability of the Apache APISIX cloud API gateway, related to bypassing authentication through spoofing, allows attackers to execute arbitrary code.

The vulnerability of the Apache APISIX cloud API gateway involves bypassing authentication through spoofing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the jwt-auth plugin for the Apache APISIX cloud API gateway allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the jwt-auth plugin for the Apache APISIX cloud API gateway is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Apache APISIX Dashboard Detection

Binary data apacheapisixdashboarddetect.nbin...

Apache APISIX Dashboard < 2.10.1 Authentication Bypass (Direct Check)

Binary data apacheapisixcve-2021-45232.nbin...

Apache APISIX Dashboard < 2.10.1 Authentication Bypass

The version of Apache APISIX Dashboard installed on the remote host is prior to 2.10.1. It is, therefore, affected by an authentication bypass vulnerability. An unauthenticated, remote attacker could exploit this to bypass authentication. Note that Nessus has not tested for these issues but has...

Apache APISIX < 2.10.4 / 2.11.x < 2.12.1 RCE

The version of Apache APISIX installed on the remote host is prior to 2.10.4 or 2.11.x prior to 2.12.1. It is, therefore, affected by a remote code execution vulnerability due to flaw in the product's source code. An unauthenticated, remote attacker can exploit this to bypass authentication and...

Apache Apisix Information Disclosure Vulnerability

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd and features dynamic routing and plugin hot-loading for API management in microservices systems. versions prior to Apache Apisix 2.13.1 contain an information...

CVE-2022-29266 apisix/jwt-auth may leak secrets in error response

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information...

PT-2022-2524 · Apache · Apache Apisix

Name of the Vulnerable Software and Affected Versions: Apache APISIX versions prior to 3.13.1 Description: The issue is related to the jwt-auth plugin of Apache APISIX, which has a security problem due to insufficient error reporting mechanisms. This can allow a remote attacker to gain unauthoriz...

Apache Apisix 安全漏洞

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd and features dynamic routing and plugin hot-loading for API management in microservices systems. versions prior to Apache Apisix 2.13.1 contain an information...

Apache APISIX HTTP Detection

Binary data apacheapisixhttpdetect.nbin...

Apache APISIX 1.2 <= 1.5 Information Disclosure

The version of Apache APISIX installed on the remote host is 1.2 prior to or equal to 1.5. It is, therefore, affected by an information disclosure vulnerability. An authenticated, remote attacker could exploit this to access Apache APISIX management data. Note that Nessus has not tested for these...

Apache APISIX Remote Code Execution (CVE-2022-24112)

A remote code execution vulnerability exists in Apache APISIX. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system...

Apache Apisix Input Validation Error Vulnerability

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd, with dynamic routing and plugin hot-loading for API management in microservices systems. An attacker could use this vulnerability to bypass the bodyschema...