PT-2021-6081 · Apache · Apache Apisix Dashboard

Zhu Yucheng · Published 2021-12-27 · Updated 2024-03-06 · CVE-2021-45232

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache APISIX Dashboard versions prior to 2.10.1

Description The issue is related to the Manager API in Apache APISIX Dashboard, which uses two frameworks, gin and droplet. While all APIs and authentication middleware are developed based on the droplet framework, some APIs directly use the interface of the gin framework, bypassing authentication. This allows a remote attacker to bypass the authentication procedure.

Recommendations For Apache APISIX Dashboard versions prior to 2.10.1, update to version 2.10.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Manager API to minimize the risk of exploitation. Avoid using the interface of the gin framework directly in APIs until the issue is resolved.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-00718

BIT-APISIX_DASHBOARD-2021-45232

CVE-2021-45232

Affected Products

Apache Apisix Dashboard

References · 18

• 🔥 https://github.com/wuppp/cve-2021-45232-exp · Exploit
• 🔥 https://github.com/GYLQ/CVE-2021-45232-RCE · Exploit
• 🔥 https://github.com/YutuSec/Apisix_Crack · Exploit
• 🔥❌ https://github.com/shakeman8/CVE-2021-45232-RCE · Exploit, Deleted
• https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-apisix_dashboard-2021-45232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45232 · Security Note
• https://bdu.fstec.ru/vul/2022-00718 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45232 · Vendor Advisory
• https://t.me/pentestingnews/16427 · Telegram Post
• https://t.me/cybersecuritytechnologies/5083 · Telegram Post
• http://openwall.com/lists/oss-security/2021/12/27/1 · Note
• https://t.me/cvenotify/25085 · Telegram Post
• https://t.me/shadow_group_tg/497 · Telegram Post
• https://t.me/pentestingnews/16399 · Telegram Post