PT-2022-17492 · Apache · Apache Apisix

Guangli Dong · Published 2022-03-28 · Updated 2024-03-06 · CVE-2022-25757

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache APISIX versions prior to 2.13.0

Description The issue allows an attacker to bypass body schema validation in the request-validation plugin by passing a JSON with a duplicate key. This can be achieved by sending a JSON payload such as {"string payload":"bad","string payload":"good"} to hide the "bad" input. The attack is successful if three conditions are met: the system uses body schema validation in the request-validation plugin, the upstream application uses a special JSON library that chooses the first occurred value (like jsoniter or gojay), and the upstream application does not validate the input anymore.

Recommendations For Apache APISIX versions prior to 2.13.0, update to version 2.13.0 or later to resolve the issue. As a temporary workaround, consider re-encoding the validated JSON input back into the request body at the side of Apache APISIX to prevent bypassing of the body schema validation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-APISIX-2022-25757

CVE-2022-25757

Affected Products

Apache Apisix

References · 5

• https://osv.dev/vulnerability/BIT-apisix-2022-25757 · Vendor Advisory
• https://lists.apache.org/thread/03vd2j81krxmpz6xo8p1dl642flpo6fv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25757 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25757 · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/03/28/2 · Note