CVE-2022-24112
About
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Rainforest analyst review
Apache APISIX ships a batch-requests plugin that lets one HTTP call fan out into several internal requests. The plugin is supposed to overwrite the client IP on those sub-requests with the real remote address so Admin API IP restrictions still apply, but a bug in that code lets an attacker set the X-Real-IP themselves and bypass the check. Combined with the well-known default Admin API key, an unauthenticated attacker can reach the Admin API from a restricted network position and push a malicious route with a Lua script, achieving remote code execution on the gateway.
APISIX sits at the edge as an API gateway, brokering traffic to backend services, so code execution there is a commanding position for pivoting and intercepting requests. The precondition that hurts most is the default API key, which many deployments never rotate. Public proof-of-concept exploits exist and the flaw is routinely probed. Upgrade to a fixed APISIX release, but the durable fix is operational: change the default Admin API key, bind the Admin API to a separate isolated port, and restrict it to trusted management networks so an IP-restriction bypass has nothing to bypass into.
References
- http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2022/02/11/3
- https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24112
Related CVEs
Frequently asked questions
What is CVE-2022-24112?
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower.
How severe is CVE-2022-24112?
CVE-2022-24112 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2022-24112 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2022-24112?
Public advisories list the following as affected: apisix. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2022-24112?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.