CVE-2022-24112

CVE-2022-24112 is a client IP validation flaw (CWE-290) in the batch-requests plugin of Apache APISIX: the plugin is supposed to override the client IP with the real remote IP, but due to a coding bug this check can be bypassed, allowing an attacker to send requests that evade the IP restrictions protecting the Admin API. A remote, unauthenticated attacker sends crafted requests through the batch-requests endpoint to reach the otherwise IP-restricted Admin API or data panel. With a default APISIX configuration (default admin API key), this grants access that leads directly to remote code execution; if the admin key was changed or the Admin API runs on a different port, the attacker still gains unauthorized access to the data panel. Any deployment of Apache APISIX is affected, with default or minimally-hardened configurations facing the highest risk. The vulnerability is under active exploitation: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-08-25, carries a 96% EPSS probability of exploitation within 30 days, and public proof-of-concept exploits are available.

What to do: Upgrade Apache APISIX to the latest patched release per vendor instructions, prioritizing internet-facing instances since active exploitation is confirmed. As immediate mitigation, change the default admin API key, restrict access to the Admin API and data panel, and avoid exposing the Admin API port alongside the data panel. Check logs for anomalous requests to the batch-requests endpoint and Admin API routes indicating exploitation attempts.