PT-2022-2524 · Apache · Apache Apisix

Bing Chen + 2 · Published 2022-04-20 · Updated 2024-03-06 · CVE-2022-29266

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache APISIX versions prior to 3.13.1

Description The issue is related to the jwt-auth plugin of Apache APISIX, which has a security problem due to insufficient error reporting mechanisms. This can allow a remote attacker to gain unauthorized access to protected information. The error message returned from the lua-resty-jwt dependency contains sensitive information, specifically the user's secret key, when an incorrect JSON Web Token is sent to a protected route. An attacker can exploit this by sending an RS256 token to an endpoint that requires an HS256 token, resulting in the original secret value being included in the error response.

Recommendations For Apache APISIX versions prior to 3.13.1, update to version 3.13.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the jwt-auth plugin or disabling the error message response from the lua-resty-jwt dependency to minimize the risk of exploitation.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2022-02939

BIT-APISIX-2022-29266

CVE-2022-29266

Affected Products

Apache Apisix

References · 7

• https://lists.apache.org/thread/6qpfyxogbvn18g9xr8g218jjfjbfsbhr · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02939 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29266 · Security Note
• https://osv.dev/vulnerability/BIT-apisix-2022-29266 · Vendor Advisory
• http://openwall.com/lists/oss-security/2022/04/20/1 · Note
• https://t.me/cvenotify/29189 · Telegram Post