CVE-2022-24112
Apache APISIX Authentication Bypass Vulnerability
Description
CVE-2022-24112 is an authentication bypass vulnerability in Apache APISIX, an open-source API gateway, that allows unauthenticated remote code execution. The vulnerability enables attackers to bypass the authentication mechanisms protecting the APISIX Admin API and execute arbitrary code on the underlying server. Apache APISIX is increasingly adopted as a cloud-native API gateway in microservices architectures, making compromised instances a gateway to entire backend service infrastructure. CISA has added CVE-2022-24112 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.4% (99th percentile), exploitation is near-certain for exposed instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apache | apisix | < 2.10.4; >= 2.11.0, < 2.12.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2022/02/11/3(Mailing List, Mitigation, Third Party Advisory)
- https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94(Mailing List, Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24112(Third Party Advisory, US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2022-24112 exploits an improper authentication weakness in Apache APISIX, where the authentication controls protecting the Admin API can be bypassed through specially crafted requests. The authentication mechanism fails to properly validate requests under certain conditions, allowing unauthenticated attackers to access administrative functions that should require valid credentials, ultimately enabling code execution on the server.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2022-24112 poses a critical risk to API infrastructure. The vulnerability is remotely exploitable over the network without authentication, requiring no user interaction and involving low attack complexity. Since Apache APISIX functions as an API gateway that sits in front of backend services, compromising it grants the attacker a privileged position to intercept, modify, or redirect all API traffic flowing through the gateway. Successful exploitation enables arbitrary code execution on the APISIX server, interception or modification of all API requests and responses, access to backend services and their credentials configured in the gateway, deployment of malicious routes that proxy traffic to attacker-controlled servers, and lateral movement into the backend service infrastructure. With an EPSS score of 94.4% (99th percentile), this vulnerability is among the most actively exploited across all known CVEs.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-24112 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 15, 2022. The EPSS score of 94.4% (99th percentile) reflects near-certain exploitation activity. Public exploit code and proof-of-concept demonstrations are available in the security community, and the authentication bypass technique is well-documented. The Apache APISIX mailing list advisory provides details on the vulnerability. No specific ransomware campaigns are currently associated with this CVE, but compromised API gateways are high-value targets for data theft and supply chain attacks.
Remediation
- Upgrade Apache APISIX immediately: Per the CISA KEV required action, apply updates per vendor instructions. Upgrade to the patched version of Apache APISIX that addresses the authentication bypass vulnerability.
- Restrict access to the Admin API: Configure network-level access controls to ensure the APISIX Admin API is only accessible from trusted management networks. The Admin API should never be exposed to the public internet.
- Enable and enforce authentication on the Admin API: Verify that the Admin API authentication key is set to a strong, unique value and that all authentication mechanisms are properly enabled in the APISIX configuration.
- Deploy a Web Application Firewall (WAF): Place a WAF in front of the APISIX instance to detect and block exploitation attempts targeting the authentication bypass vulnerability.
- Audit API gateway configurations and routes: Review all configured routes, plugins, and upstream services for unauthorized modifications that could indicate a previous compromise. Monitor APISIX access logs for suspicious administrative API calls.
Technical Details
CVE-2022-24112 is an authentication bypass vulnerability in the Apache APISIX Admin API. Apache APISIX uses an Admin API for managing routes, services, plugins, and other gateway configurations, which is protected by an API key authentication mechanism. The vulnerability allows an attacker to bypass this authentication through specially crafted HTTP requests that exploit a flaw in how the batch-requests plugin interacts with the Admin API authentication layer. By leveraging this plugin, an attacker can send requests that reach the Admin API without the required authentication key, gaining full administrative control over the API gateway. With administrative access, the attacker can create new routes with malicious plugin configurations that execute arbitrary Lua code or system commands, effectively achieving remote code execution on the APISIX server.
Frequently Asked Questions
Is CVE-2022-24112 being actively exploited?
Yes. CISA has added CVE-2022-24112 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.4% (99th percentile) indicates near-certain exploitation for exposed instances. Public exploit code is available.
What products are affected by CVE-2022-24112?
CVE-2022-24112 affects Apache APISIX, an open-source API gateway. The vulnerability is present in versions prior to the security fix documented in the Apache APISIX mailing list advisory. All APISIX installations with the Admin API accessible from untrusted networks are at risk.
How do I fix CVE-2022-24112?
Upgrade Apache APISIX to the latest patched version. Restrict Admin API access to trusted management networks only and ensure authentication keys are set to strong, unique values. Deploy network-level controls to prevent public internet access to the Admin API.
How severe is CVE-2022-24112?
CVE-2022-24112 is a critical severity authentication bypass that enables unauthenticated remote code execution on Apache APISIX. With an EPSS score of 94.4% (99th percentile), it is among the most actively exploited vulnerabilities. Compromising an API gateway provides attackers with a privileged position to intercept all API traffic and access backend services.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.