CVE-2022-241129.8CriticalCWE-290

CVE-2022-24112: apisix/batch-requests plugin allows overwriting the X-REAL-IP header

Apache Software Foundation · Apache APISIX

Vendor fix available · Affected: Apache Software Foundation Apache APISIX · Exploitation: in CISA KEV since 25 Aug 2022

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

ExploitationIn CISA KEV

In CISA KEVCISA KEV catalogue25 Aug 2022
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not established: not seen

96.1%probability of exploitation in the next 30 days

99th percentile

050100

Higher than 99% of scored CVEs

9.8CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Apache Software Foundation · Apache APISIXfrom Apache APISIX 2.12 before 2.12.1; from Apache APISIX 2.10 before 2.10.4; from 1.3 before Apache APISIX 1*

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
CISA KEV: Listed since 25 Aug 2022 · catalogue entry
Public check: Apache APISIX - Remote Code Execution · nuclei template in projectdiscovery/nuclei-templates
Weakness: Authentication Bypass by Spoofing · Authentication
Vendor: Apache Software Foundation
Published: February 2022
Band: Exploited in the wild, February 2022

What changed

25 Aug 2022
CISA added it to the KEV catalogue CISA

CoverageNo articles yet

No CyberSIXT article names CVE-2022-24112 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.