Apache Apisix
Known Exploited Apache Apisix Vulnerabilities
The following Apache Apisix vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Apache APISIX Authentication Bypass Vulnerability | Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution. CVE-2022-24112 | August 25, 2022 |
By the Year
In 2024 there have been 0 vulnerabilities in Apache Apisix . Last year Apisix had 1 security vulnerability published. Right now, Apisix is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 1 | 7.50 |
| 2022 | 3 | 9.03 |
| 2021 | 1 | 7.50 |
| 2020 | 1 | 6.50 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Apisix vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Apisix Security Vulnerabilities
The HTTP/2 protocol
CVE-2023-44487
7.5 - High
- October 10, 2023
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Resource Exhaustion
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue
CVE-2022-29266
7.5 - High
- April 20, 2022
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.
Generation of Error Message Containing Sensitive Information
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result
CVE-2022-25757
9.8 - Critical
- March 28, 2022
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the body_schema validation in the request-validation plugin. For example, `{"string_payload":"bad","string_payload":"good"}` can be used to hide the "bad" input. Systems satisfy three conditions below are affected by this attack: 1. use body_schema validation in the request-validation plugin 2. upstream application uses a special JSON library that chooses the first occurred value, like jsoniter or gojay 3. upstream application does not validate the input anymore. The fix in APISIX is to re-encode the validated JSON input back into the request body at the side of APISIX. Improper Input Validation vulnerability in __COMPONENT__ of Apache APISIX allows an attacker to __IMPACT__. This issue affects Apache APISIX Apache APISIX version 2.12.1 and prior versions.
Improper Input Validation
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API
CVE-2022-24112
9.8 - Critical
- February 11, 2022
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Authentication Bypass by Spoofing
The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification
CVE-2021-43557
7.5 - High
- November 22, 2021
The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.
Command Injection
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules
CVE-2020-13945
6.5 - Medium
- December 07, 2020
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Apisix or by Apache? Click the Watch button to subscribe.
