apisix/batch-requests plugin allows overwriting the X-REAL-IP header

The batch-requests plugin in Apache APISIX has a flaw that allows attackers to bypass IP address restrictions and potentially execute code on the server. By manipulating requests, an attacker can impersonate a trusted IP address and gain unauthorized access to the Admin API.

The batch-requests plugin attempts to validate client IP addresses by overriding them with the real remote IP; however, a logic error in this validation allows attackers to bypass the check via crafted batch requests. This enables unauthorized access to the Admin API, and when default credentials are in place, can lead to remote code execution. Requires network access to the APISIX instance.