437 lines
21 KiB
HTML
437 lines
21 KiB
HTML
<!DOCTYPE html><html lang="en" theme-color="default" theme-mode=""><head>
|
|
<meta charset="UTF-8">
|
|
<title>Apache APISIX remote code execution vulnerability warning - JSKCloud</title>
|
|
<meta name="keywords" content="Documentation">
|
|
<meta name="description" content="Our help documentation provides a wealth of information and resources, including product manuals, technical documents, etc. You can easily find the information you need to help you better understand our products and services. We are constantly updating and improving our documentation to ensure you always have the latest information.">
|
|
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<meta http-equiv="Content-Language" content="en">
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="../assets/92c1df3730f31c-iconfont.css">
|
|
<link rel="stylesheet" href="../assets/7bd641cba5f6a0-reset.css">
|
|
<link rel="stylesheet" href="../assets/478794f28834cd-style.css">
|
|
<link rel="stylesheet" href="../assets/e5adc0b1fcadda-theme.css">
|
|
<link rel="stylesheet" href="../assets/054352c1c64ab4-common.css">
|
|
<link rel="stylesheet" href="../assets/51c94e2cd9af75-animate.css">
|
|
<script src="../assets/dea655e39abf18-jquery-3.5.1.min.js"></script>
|
|
|
|
|
|
<link rel="stylesheet" href="../assets/43319114264162-bootstrap.min.css">
|
|
<script src="../assets/b7c64cb3919aba-bootstrap.min.js"></script>
|
|
|
|
<link rel="stylesheet" href="../assets/c7ac28884e5076-swiper-bundle.min.css">
|
|
<script src="../assets/130071f2a87d70-swiper-bundle.min.js"></script>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="../assets/b828918322b016-document.css">
|
|
|
|
<style>
|
|
/* 移动端适配 */
|
|
@media (max-width: 768px) {
|
|
/* 横幅区域优化 */
|
|
.server-banner2.banner-document {
|
|
padding: 30px 0;
|
|
}
|
|
|
|
.server-banner2 .section-content {
|
|
padding: 0 15px;
|
|
}
|
|
|
|
.server-banner2 h1 {
|
|
font-size: 24px;
|
|
margin-bottom: 12px;
|
|
}
|
|
|
|
.server-banner-desc2 {
|
|
font-size: 14px;
|
|
line-height: 1.6;
|
|
margin-bottom: 25px;
|
|
}
|
|
|
|
/* 搜索框适配 */
|
|
.input-search {
|
|
width: 100%;
|
|
flex-direction: column;
|
|
}
|
|
|
|
#document-input {
|
|
width: 100% !important;
|
|
margin-bottom: 10px;
|
|
height: 44px !important;
|
|
}
|
|
|
|
.search-btn {
|
|
width: 100% !important;
|
|
/* height: 44px !important;
|
|
line-height: 44px !important; */
|
|
text-align: center;
|
|
}
|
|
|
|
/* 文档列表适配 */
|
|
.docement-list {
|
|
margin: 0;
|
|
flex-direction: column;
|
|
}
|
|
|
|
.docement-list .document-box {
|
|
width: 100%;
|
|
min-height: auto;
|
|
margin: 10px 0;
|
|
padding: 20px;
|
|
box-sizing: border-box;
|
|
}
|
|
|
|
.document-box .document-header {
|
|
padding-bottom: 15px;
|
|
}
|
|
|
|
.document-box a {
|
|
font-size: 14px;
|
|
line-height: 1.6;
|
|
height: auto;
|
|
}
|
|
|
|
/* 隐藏桌面端导航 */
|
|
.page .nav-left {
|
|
display: none;
|
|
}
|
|
|
|
.page .nav-right,
|
|
.page .content-page {
|
|
padding-left: 0;
|
|
left: 0;
|
|
}
|
|
|
|
/* 内容区域优化 */
|
|
.page .page-content {
|
|
padding: 20px 15px;
|
|
margin-left: 0;
|
|
height: auto;
|
|
}
|
|
|
|
.document-cont {
|
|
padding: 20px 0 !important;
|
|
}
|
|
|
|
/* 文档详情适配 */
|
|
.document-details .document-view-item .document-view-cont {
|
|
padding: 15px;
|
|
}
|
|
|
|
.document-details .document-view-item .document-view-cont a {
|
|
width: 100%;
|
|
padding-right: 0;
|
|
}
|
|
}
|
|
|
|
/* 小屏幕优化 (≤480px) */
|
|
@media (max-width: 480px) {
|
|
.document-box {
|
|
padding: 15px !important;
|
|
}
|
|
|
|
.document-header img {
|
|
width: 24px !important;
|
|
height: 24px !important;
|
|
}
|
|
|
|
.document-details .document-view-head {
|
|
padding-left: 15px !important;
|
|
}
|
|
|
|
.page .page-content .document-head h2 {
|
|
font-size: 20px;
|
|
}
|
|
}
|
|
</style>
|
|
<link rel="canonical" href="../en/announce/2.html"><link rel="alternate" hreflang="zh-Hans" href="../zh-cn/announce/2.html"><link rel="alternate" hreflang="zh-Hant" href="../zh-hk/announce/2.html"><link rel="alternate" hreflang="en" href="../en/announce/2.html"><link rel="stylesheet" href="../assets/site.css"><link rel="stylesheet" href="../assets/b0317f003749a5-css2.css"><link rel="stylesheet" href="../assets/de0a696a420db8-css2.css"><link rel="stylesheet" href="../assets/13192273b45a60-css2.css"></head>
|
|
|
|
<body data-static-site="jskcloud"><header><style>
|
|
/* 语言选择器样式 */
|
|
.language-selector {
|
|
position: relative;
|
|
margin-right: 20px;
|
|
cursor: pointer;
|
|
z-index: 99999;
|
|
}
|
|
|
|
.language-selected {
|
|
display: flex;
|
|
align-items: center;
|
|
padding: 8px 12px;
|
|
border-radius: 6px;
|
|
background-color: rgba(255, 255, 255, 0.1);
|
|
transition: all 0.3s ease;
|
|
}
|
|
|
|
.language-selected:hover {
|
|
background-color: rgba(255, 255, 255, 0.2);
|
|
}
|
|
|
|
.language-flag {
|
|
margin-right: 8px;
|
|
font-size: 16px;
|
|
}
|
|
|
|
.language-code {
|
|
font-weight: 500;
|
|
margin-right: 8px;
|
|
}
|
|
|
|
.language-arrow {
|
|
transition: transform 0.3s ease;
|
|
}
|
|
|
|
.language-selector.active .language-arrow {
|
|
transform: rotate(180deg);
|
|
}
|
|
|
|
.language-dropdown {
|
|
position: absolute;
|
|
top: 100%;
|
|
/* right: 0; */
|
|
width: 140px;
|
|
background: #fff;
|
|
border-radius: 8px;
|
|
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);
|
|
opacity: 0;
|
|
visibility: hidden;
|
|
transform: translateY(10px);
|
|
transition: all 0.3s ease;
|
|
z-index: 1000;
|
|
}
|
|
|
|
.language-selector.active .language-dropdown {
|
|
opacity: 1;
|
|
visibility: visible;
|
|
transform: translateY(0);
|
|
}
|
|
|
|
.language-option {
|
|
display: flex;
|
|
align-items: center;
|
|
padding: 10px 12px;
|
|
color: #333;
|
|
transition: all 0.2s ease;
|
|
}
|
|
|
|
.language-option:hover {
|
|
background-color: #f5f5f5;
|
|
}
|
|
|
|
.language-option .language-flag {
|
|
margin-right: 10px;
|
|
}
|
|
|
|
.language-name {
|
|
font-size: 14px;
|
|
}
|
|
</style>
|
|
<div class="nav-shadow">
|
|
<div class="section-content nav-header">
|
|
<div class="nav-left">
|
|
<div class="nav-icon">
|
|
<a href="../en/index.html"><img src="../assets/f47e84e194e9c4-c47cdbdba8c01d82740fc430f77aaa6f1792437534-222.png" alt=""></a>
|
|
</div>
|
|
<div class="nav-menu">
|
|
<div>
|
|
<a href="../en/index.html">
|
|
<div class="nav-item">Products</div>
|
|
</a>
|
|
<div class="nav-cont">
|
|
<div class="section-content">
|
|
<div class="nav-cont-menu animated slideInDown">
|
|
<div class="nav-content ">
|
|
<a href="../en/cloud.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">Cloud Server</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
<a href="../en/dedicated.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">Dedicated Server</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
<a href="../en/balance.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">Load Balancer</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
<a href="../en/box.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">BOX server</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div>
|
|
<a href="../en/index.html">
|
|
<div class="nav-item">About Us</div>
|
|
</a>
|
|
<div class="nav-cont">
|
|
<div class="section-content">
|
|
<div class="nav-cont-menu animated slideInDown">
|
|
<div class="nav-content ">
|
|
<a href="../en/about.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">Company Profile</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
<a href="../en/contact.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">Contact Us</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="mobile-menu-btn" id="mobileMenuBtn"></div>
|
|
</div>
|
|
<div class="nav-right">
|
|
|
|
|
|
<div class="language-selector">
|
|
<div class="language-selected">
|
|
<span class="language-flag">🌐</span>
|
|
<span class="language-code">English</span>
|
|
<svg class="language-arrow" width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg">
|
|
<path d="M1 1L5 5L9 1" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"></path>
|
|
</svg>
|
|
</div>
|
|
<div class="language-dropdown">
|
|
<a class="language-option" data-lang="en" href="../en/announce/2.html" lang="en" hreflang="en" aria-current="true">English</a>
|
|
<a class="language-option" data-lang="zh-cn" href="../zh-cn/announce/2.html" lang="zh-cn" hreflang="zh-cn">简体中文</a>
|
|
<a class="language-option" data-lang="zh-hk" href="../zh-hk/announce/2.html" lang="zh-hk" hreflang="zh-hk">繁體中文</a>
|
|
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<div class="aside-tools">
|
|
<div class="tools-list">
|
|
<div class="tools-item">
|
|
<a class="static-contact-trigger" href="https://t.me/JSKCDN999" target="_blank" aria-label="Contact JSKCloud on Telegram" rel="noopener noreferrer"><img src="../assets/82c093ab92edb0-f801662fa2daa58d6b518f4642a32aed1742560323-tg.jpg" alt=""></a>
|
|
<div class="tools-box">
|
|
<div class="tools-box-s"><h5>Contact Support</h5><p><a target="_blank" href="https://t.me/JSKCDN999" rel="noopener noreferrer">@JSKCDN999</a></p></div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
</header><main class="static-main"><article class="static-article"><h1>Apache APISIX remote code execution vulnerability warning</h1><div class="static-date">2023-03-31</div>
|
|
<div data-version="3.0.0" data-hash="c602be17153e25d0db9d0f388b924397"> </div>
|
|
<div>
|
|
<div class="document">
|
|
<div class="section">
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Respectful master's command:</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px; text-indent: 21pt;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Hello! Apache APISIX officially issued a security notice, disclosing a remote code execution vulnerability in the APISIX batch-requests plug-in, with vulnerability number CVE-2022-24112. It can cause attackers to remotely execute arbitrary code and other hazards.</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">[Vulnerability Rating]</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">High risk</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">[Vulnerability description]</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">CVE-2022-24112</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Attackers can abuse the batch-requests plug-in to send specially crafted requests and use this to bypass the IP restrictions of the Admin API, such as bypassing IP black and white list restrictions. Or when the user uses the Apache APISIX default configuration (enables the Admin API, uses the default Admin Key and does not assign an additional management port), the attacker can call the Admin API through the batch-requests plug-in, leading to remote code execution.</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">[scope of influence]</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Affected versions:</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache APISIX < 2.12.1</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache APISIX < 2.10.4 (LTS versions)</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">[Repair Plan]</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Official vulnerability patches and repair versions have been released. Please evaluate whether your business is affected and upgrade to a safe version as appropriate.</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">https://github.com/apache/apisix/releases/tag/2.12.1</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">https://github.com/apache/apisix/releases/tag/2.10.4</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Note: Please back up your data and conduct full testing before fixing the vulnerability.</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">[Reference link]</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">https://apisix.apache.org/zh/blog/2022/02/11/cve-2022-24112/</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">https://nvd.nist.gov/vuln/detail/CVE-2022-24112</span></p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<a class="static-back" href="../en/announce.html">Back to List</a></article></main><footer class="section footer index">
|
|
|
|
<div class="section-content section-p">
|
|
|
|
|
|
<div class="footer-content">
|
|
<div class="footer-nav">
|
|
<div class="footer-logo">
|
|
<img src="../assets/f47e84e194e9c4-c47cdbdba8c01d82740fc430f77aaa6f1792437534-222.png" alt="">
|
|
</div>
|
|
<div class="footer-nav-left">
|
|
<div class="footer-nav-box">
|
|
<div class="footer-nav-head">Products</div>
|
|
<div class="footer-nav-cont">
|
|
<div class="footer-nav-item"><a class="link-hover" href="../en/cloud.html">Cloud Server</a></div>
|
|
<div class="footer-nav-item"><a class="link-hover" href="../en/dedicated.html">Dedicated Server</a></div>
|
|
<div class="footer-nav-item"><a class="link-hover" href="../en/balance.html">Load Balancer</a></div>
|
|
<div class="footer-nav-item"><a class="link-hover" href="../en/box.html">Box server</a></div>
|
|
</div>
|
|
</div>
|
|
<div class="footer-nav-box">
|
|
<div class="footer-nav-head">Support</div>
|
|
<div class="footer-nav-cont">
|
|
<div class="footer-nav-item"><a class="link-hover" href="../en/document.html">Documentation</a></div>
|
|
</div>
|
|
</div>
|
|
<div class="footer-nav-box">
|
|
<div class="footer-nav-head">About Us</div>
|
|
<div class="footer-nav-cont">
|
|
<div class="footer-nav-item"><a class="link-hover" href="../en/about.html">Company Profile</a></div>
|
|
<div class="footer-nav-item"><a class="link-hover" href="../en/contact.html">Contact Us</a></div>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
<div class="footer-nav-right">
|
|
<div class="footer-nav-box"><div class="footer-nav-head">Contact Us</div><div class="footer-nav-cont"><div class="footer-nav-item">JSKCloud.net</div><div class="footer-nav-item mt-20"><a class="link-hover" href="https://t.me/JSKCDN999" target="_blank" rel="noopener noreferrer">Telegram @JSKCDN999</a></div></div></div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<div class="footer-record">
|
|
<div class="left-info">
|
|
<a href="../en/index.html" rel="nofollow"> Copyright@2017-2024 JSK cloud TECHNOLOGY PTE. LTD All Rights Reserved</a>
|
|
<a href="../en/index.html" rel="nofollow"> </a>
|
|
<span> </span>
|
|
</div>
|
|
<span> </span>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
</footer><script src="../assets/site.js" defer=""></script></body></html> |