PT-2020-13796 · Apache · Apache Apisix

Published 2020-12-07 · Updated 2025-12-30 · CVE-2020-13945

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 1.2 through 1.5

Description The issue arises when the Admin API is enabled and the Admin API access IP restriction rules are deleted in Apache APISIX. This allows the default token to access APISIX management data.

Recommendations For versions 1.2 through 1.5, restrict access to the Admin API by reconfiguring the IP restriction rules to prevent unauthorized access to management data. As a temporary workaround, consider disabling the Admin API until a more secure configuration can be implemented. Restrict the use of the default token to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BIT-APISIX-2020-13945

CVE-2020-13945

Affected Products

Apache Apisix

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_apisix_api_default_token_rce.rb · Exploit
• 🔥 https://github.com/K3ysTr0K3R/CVE-2020-13945-EXPLOIT · Exploit
• 🔥 https://github.com/YutuSec/Apisix_Crack · Exploit
• 🔥 http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html · Exploit
• https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/BIT-apisix-2020-13945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13945 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13945 · Vendor Advisory
• https://t.me/cvenotify/6699 · Telegram Post
• https://twitter.com/BarotOm85862/status/2005990680515207290 · Twitter Post
• https://t.me/cvenotify/6724 · Telegram Post
• https://t.me/cibsecurity/17209 · Telegram Post
• https://twitter.com/hackviserr/status/1978068277944332516 · Twitter Post
• https://t.me/cvenotify/6693 · Telegram Post