Sploitus

Exploit for Authentication Bypass by Spoofing in Apache Apisix

CVE-2021-45232CVE-2022-24112

githubexploit · 2022-02-22

Exploit Code

README20 lines
## https://sploitus.com/exploit?id=56FCCA36-707C-5527-A9EF-728C3490C6FC
# CVE-2022-24112  
CVE-2022-24112: Apache APISIX apisix/batch-requests RCE  

**nuclei template**: [CVE-2022-24112.yaml](./CVE-2022-24112.yaml)  

This vulnerability involves exploiting a flaw similar to [CVE-2021-45232](https://xz.aliyun.com/t/10738), where malicious scripts or filters_func are executed without proper authorization.  

**Note:**  
- The value of `X-Real-IP` can be `127.0.0.1`, `localhost`, or `2130706433`.  
- `pipeline` is required; the values for its body section are as follows:  
- `Method` is fixedly set to `PUT`.  
- `URI` must exist; it’s the URL that needs to be accessed after execution.  
- At least one of the fields `plugins`, `upstream/upstream_id`, and `service_id` must be present. For more details, refer to the official documentation.  

If `service_id` is not available, you can replace it with `"upstream":{"type":"roundrobin","nodes":{"httpbin.org:80":1}}".  

**References:**  
- https://twitter.com/sirifu4k1/status/1496043663704858625  
- https://apisix.apache.org/zh/docs/apisix/plugins/batch-requests