CVE-2022-24112 PoC — apisix/batch-requests plugin allows overwriting the X-REAL-IP header

Source

Associated Vulnerability

Readme

# Apache APISIX 2.12.x Remote Code Execution (RCE) Exploit

This Python script is a Proof-of-Concept (PoC) for a remote code execution (RCE) vulnerability in Apache APISIX versions 2.12.0 and 2.12.1.

The vulnerability lies in the misuse of the `filter_func` Lua field within the admin API, allowing an attacker to inject arbitrary Lua code that executes system commands via `io.popen`. The response from the command is returned in the HTTP response using `ngx.say()`.

> ⚠️ **DISCLAIMER**: This tool is intended for authorized testing and educational purposes only. Do not use it on systems you do not own or have explicit permission to test.

---

## 🧰 Requirements

- Python 3.6+
- `requests` library (`pip install requests`)

---

## 🚀 Usage

### 📁 File Name
`exploit.py`

### 🔧 Syntax

```bash
python3 exploit.py -d <target_domain_or_ip> -p <port> -c <command>
```
```bash
python3 exploit.py -d 127.0.0.1 -p 9080 -c id
python3 exploit.py --domain 192.168.1.100 --cmd "uname -a"
python3 exploit.py -d vulnerable.host.local -c "cat /etc/passwd"
```

File Snapshot

 [4.0K]  /data/pocs/7afa866951a9829e939cca987fca9e83de26f76f
├── [2.5K]  exploit.py
└── [1.0K]  README.md

0 directories, 2 files

Remarks