CVE-2022-24112
Description
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Summary dbcve.org
The batch-requests plugin in Apache APISIX contains a code bug in its real-client-IP handling logic that allows an attacker to bypass IP-based restrictions on the Admin API. Because the Admin API accepts requests that can be chained through the batch-requests endpoint, an unauthenticated remote attacker reaching the data-plane can forward crafted calls to the Admin API; in default installations (default API key, default admin port) this results in remote code execution, and in hardened installations it still bypasses IP allowlisting of the data/control panel boundary.
Mitigation
Upgrade Apache APISIX to a version that fixes the batch-requests IP-override check; additionally rotate the Admin API key away from the default and bind the Admin API to a non-data-plane port or restrict it at the network layer as defense in depth.