Non notée
Exploitée
CVE-2022-24112 Apache APISIX Authentication Bypass Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply updates per vendor instructions.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-290
Description
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache APISIX 2.12 | premières → < 2.12.1 | 2.12.1 |
| Apache APISIX 2.10 | premières → < 2.10.4 | 2.10.4 |
| Apache APISIX 1.3 | 1.3 → dernières | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
- [oss-security] 20220211 CVE-2022-24112: Apache APISIX: apisix/batch-requests plugin allows overwriting the X-REAL-IP header www.openwall.com
- packetstormsecurity.com packetstormsecurity.com
- packetstormsecurity.com packetstormsecurity.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de Apache APISIX
Les 34 CVE de Apache APISIX →
CVE-2026-94276
Improper Authentication vulnerability in Apache APISIX
5.1
Moyenne
CVE-2026-94269
Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX
6.3
Moyenne
CVE-2026-94250
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX
8.2
Élevée
CVE-2026-94220
Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX
2.1
Faible