PT-2022-2569 · Apache · Apache Apisix

Published 2022-02-11 · Updated 2025-10-23 · CVE-2022-24112

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.12.1

Description The issue concerns an authentication bypass vulnerability in Apache APISIX, where an attacker can exploit the batch-requests plugin to send requests and bypass the IP restriction of the Admin API. This can lead to remote code execution, particularly in default configurations with the default API key. Changing the admin key or using a different port for the Admin API than the data panel reduces the impact but still poses a risk of bypassing the IP restriction of the data panel. A bug in the code allows the check that overrides the client IP with its real remote IP to be bypassed.

Recommendations For Apache APISIX version 2.12.1, consider disabling the batch-requests plugin until a patch is available to prevent the exploitation of this vulnerability. Additionally, changing the default API key and using a different port for the Admin API than the data panel can help minimize the risk. However, the most effective resolution would be to update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2022-03010

BIT-APISIX-2022-24112

CVE-2022-24112

Affected Products

Apache Apisix

References · 35

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_apisix_api_default_token_rce.rb · Exploit
• 🔥 https://github.com/Mr-xn/CVE-2022-24112 · Exploit
• 🔥 https://github.com/M4xSec/Apache-APISIX-CVE-2022-24112 · Exploit
• 🔥 https://github.com/twseptian/cve-2022-24112 · Exploit
• 🔥 https://github.com/Axx8/CVE-2022-24112 · Exploit
• 🔥 https://github.com/Mah1ndra/CVE-2022-24112 · Exploit
• 🔥 https://github.com/Acczdy/CVE-2022-24112_POC · Exploit
• 🔥❌ https://github.com/Udyz/CVE-2022-24112 · Exploit, Deleted
• 🔥 http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/50829 · Exploit
• https://osv.dev/vulnerability/BIT-apisix-2022-24112 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24112 · Security Note
• https://bdu.fstec.ru/vul/2022-03010 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24112 · Vendor Advisory