CVE-2022-24112: Apache APISIX Authentication Bypass Vulnerability

Vulnerability summary

CVE-2022-24112 is a critical (CVSS 9.8) Authentication Bypass by Spoofing vulnerability in Apache APISIX. It is known to be exploited: CISA lists it, first on 25-08-2022. EPSS estimates a 96.07% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 11-02-2022
   PublishedVulnerability first disclosed.
2. 25-08-2022
   Added to CISA KEVApache APISIX Authentication Bypass Vulnerability
3. 15-09-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

• CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.