CVE-2022-24112criticalunder attackCWE-290

CVE-2022-24112: critical vulnerability in Apache APISIX

apisix/batch-requests plugin allows overwriting the X-REAL-IP header

Published · Updated

Follow this CVE+ Monitor Apache APISIX

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 96%
from disclosure to weapon11 days
Published on NVDFeb 11
1st PoC+11d
metasploitDec 7
CISA KEV+195d
Action required by CISAfederal deadline: 2022-09-15

Apply updates per vendor instructions.

In short

The batch-requests plugin in Apache APISIX has a flaw that allows attackers to bypass IP address restrictions and potentially execute code on the server. By manipulating requests, an attacker can impersonate a trusted IP address and gain unauthorized access to the Admin API.

Technical detail

The batch-requests plugin attempts to validate client IP addresses by overriding them with the real remote IP; however, a logic error in this validation allows attackers to bypass the check via crafted batch requests. This enables unauthorized access to the Admin API, and when default credentials are in place, can lead to remote code execution. Requires network access to the APISIX instance.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache APISIX
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache APISIX

In the same product, most dangerous first.

CVE-2020-13945—CVE-2020-13945EPSS 73.6%CVE-2021-43557—Path traversal in request_uri variableEPSS 13.0%CVE-2022-29266—apisix/jwt-auth may leak secrets in error responseEPSS 8.1%CVE-2022-25757—Apache APISIX: the body_schema check in request-validation plugin can be bypassedEPSS 2.5%CVE-2024-32638MEDIUMApache APISIX: Forward-Auth Request SmugglingEPSS 1.1%CVE-2026-75005HIGHApache APISIX: Unauthenticated CPU-exhaustion DoSEPSS 0.7%