22 matches found
CVE-2022-24112_POC
POC Collected POCs CVE-2022-24112 To set up the Chunqiu Cloud Environment: CVE-2022-24112 target environment, two POCs were modified, slightly adapted from the POCs of M4xSec and twseptian for the Chunqiu Cloud Environment: Chunqiu Cloud Environment: CVE-2022-24112: Apache APISIX is a cloud-nativ...
Apache APISIX - Remote Code Execution
A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...
Apache-APISIX-CVE-2022-24112
Apache APISIX Remote Code Execution CVE-2022-24112 Exploit Summary An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key w...
BIT-APISIX-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...
CVE-2026-94250
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...
CVE-2026-94250
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...
CVE-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...
EUVD-2026-90767
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...
CVE-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...
CVE-2026-94250
Apache APISIX versions 1.3.0 through 3.18.0 are vulnerable to an allocation of resources without limits or throttling flaw within the batch-requests plugin . An unauthenticated caller can trigger an Out of Memory (OOM) condition on a gateway worker by targeting a route where the batch-requests pl...
PT-2026-103833
Name of the Vulnerable Software and Affected Versions Apache APISIX versions 1.3.0 through 3.18.0 Description The batch-requests plugin contains a flaw where resources are allocated without limits or throttling. An unauthenticated caller can cause a gateway worker to experience Out of Memory OOM—...
CVE-2022-24112
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...
Exploit for Authentication Bypass by Spoofing in Apache Apisix
Apache APISIX Remote Code Execution CVE-2022-24112 Exploit...
Apache Apisix Remote Code Execution Vulnerability
Apache Apisix is a cloud-native microservice API gateway service from the Apache Foundation. The software is based on OpenResty and etcd to realize , with dynamic routing and plug-in hot loading , suitable for microservice system under the API management . A remote code execution vulnerability...
CVE-2022-24112
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...
Default configuration
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...
CVE-2022-24112 apisix/batch-requests plugin allows overwriting the X-REAL-IP header
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...
CVE-2022-24112
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different...
CVE-2022-24112
CVE-2022-24112 affects Apache APISIX. It arises from the batch-requests plugin, where a bug can bypass the Admin API IP restriction, enabling remote code execution. Exploits/PoCs exist for APISIX 2.12.0–2.12.1 demonstrating RCE via admin API path and Lua code injection in routes, with documented ...
PT-2022-2569
Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.12.1 Description The issue concerns an authentication bypass vulnerability in Apache APISIX, where an attacker can exploit the batch-requests plugin to send requests and bypass the IP restriction of the Admin API. This...