Apache APISIX remote code execution vulnerability warning

Respectful master's command:

Hello! Apache APISIX officially issued a security notice, disclosing a remote code execution vulnerability in the APISIX batch-requests plug-in, with vulnerability number CVE-2022-24112. It can cause attackers to remotely execute arbitrary code and other hazards.

[Vulnerability Rating]

High risk

[Vulnerability description]

CVE-2022-24112

Attackers can abuse the batch-requests plug-in to send specially crafted requests and use this to bypass the IP restrictions of the Admin API, such as bypassing IP black and white list restrictions. Or when the user uses the Apache APISIX default configuration (enables the Admin API, uses the default Admin Key and does not assign an additional management port), the attacker can call the Admin API through the batch-requests plug-in, leading to remote code execution.

[scope of influence]

Affected versions:

Apache APISIX < 2.12.1

Apache APISIX < 2.10.4 (LTS versions)

[Repair Plan]

Official vulnerability patches and repair versions have been released. Please evaluate whether your business is affected and upgrade to a safe version as appropriate.

https://github.com/apache/apisix/releases/tag/2.12.1

https://github.com/apache/apisix/releases/tag/2.10.4

Note: Please back up your data and conduct full testing before fixing the vulnerability.

[Reference link]

https://apisix.apache.org/zh/blog/2022/02/11/cve-2022-24112/

https://nvd.nist.gov/vuln/detail/CVE-2022-24112