CVE-2022-24112
Apache APISIX Authentication Bypass Vulnerability
Apache APISIX
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Exploitation status
CISA Known Exploited Vulnerabilities
Listed by CISA on 25 August 2022. US federal agencies were required to remediate it by 15 September 2022.
EPSS — exploitation probability
FIRST puts the probability of exploitation activity in the next 30 days at 96.1%, which is higher than 99.9% of all scored vulnerabilities. EPSS is a forecast of activity, not a measure of severity, and it is rescored daily.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently asked questions
Is CVE-2022-24112 being exploited by ransomware groups?
No ransomware group in this database is currently recorded as exploiting CVE-2022-24112.
What does CVE-2022-24112 affect?
CVE-2022-24112 affects Apache APISIX. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
How severe is CVE-2022-24112?
CVE-2022-24112 is rated CRITICAL with a CVSS base score of 9.8. EPSS puts the probability of exploitation in the next 30 days at 96.1%, higher than 99.9% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 15 September 2022.
How should organisations respond to CVE-2022-24112?
Apply the vendor patch for Apache APISIX as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.