CVE-2022-24112 PoC — apisix/batch-requests plugin allows overwriting the X-REAL-IP header

Source

https://github.com/Mr-xn/CVE-2022-24112

Associated Vulnerability

Title:apisix/batch-requests plugin allows overwriting the X-REAL-IP header (CVE-2022-24112)
Description:An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

Description

CVE-2022-24112：Apache APISIX apisix/batch-requests RCE

Readme

# CVE-2022-24112 
CVE-2022-24112：Apache APISIX apisix/batch-requests RCE

nuclei template ：[CVE-2022-24112.yaml](./CVE-2022-24112.yaml)

<img width="885" alt="shotpic_2022-02-22_23-36-38" src="https://user-images.githubusercontent.com/18260135/155166040-5538b9ed-26b0-4c82-8d96-848e7cbf1604.png">

这个漏洞本质利用和 [CVE-2021-45232](https://xz.aliyun.com/t/10738) 类似，都是绕过授权或未授权，来执行恶意的 route 里的 filter_func 或者 script 来执行命令

## 注意是事项

- `X-Real-IP` 的值可以是 `127.0.0.1`,`localhost` 或者 `2130706433` 
- `pipeline` 是必须项，以下为其 body 部分的值说明
-  `method` 固定为 `PUT`
-  `uri` 必须存在，这也是 exp 后需要访问来触发的 URL
-  `plugins`,`upstream/upstream_id`,`service_id` 这三个必须存在其中一个，详情可以参考官方文档

如果 service_id 不可用 可以替换成 `\"upstream\":{\"type\":\"roundrobin\",\"nodes\":{\"httpbin.org:80\":1}}`

参考:
- https://twitter.com/sirifu4k1/status/1496043663704858625
- https://apisix.apache.org/zh/docs/apisix/plugins/batch-requests

File Snapshot


 [4.0K]  /data/pocs/d4353a66a0ae992e87be6083d45f499762de147b
├── [2.5K]  CVE-2022-24112.yaml
├── [ 11K]  LICENSE
└── [1.1K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!