CVE-2020-13945

published 2020-12-07

CVE-2020-13945: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access…

Priority P2 62 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

EXPLOIT

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
apache	apisix	1.2 – 1.5	—
apache_software_foundation	apache_apisix	—	—
apache_software_foundation	apache_apisix	—	—
apache_software_foundation	apache_apisix	—	—
apache_software_foundation	apache_apisix	—	—

Detection & IOCs extracted from sources · hover to see the quote

other edd1c9f034335f136f87ad84b625c8f1↗

url /apisix/admin/routes↗

command GET /{{randstr}}?cmd=id HTTP/1.1↗

cookie X-API-KEY: edd1c9f034335f136f87ad84b625c8f1↗

• → Detect exploitation attempts by looking for POST requests to /apisix/admin/routes containing the default API token 'edd1c9f034335f136f87ad84b625c8f1' in the X-API-KEY header, combined with a 'script' field in the JSON body (used for LUA code injection). ↗
• → A successful exploitation response to POST /apisix/admin/routes will return HTTP 201 and a JSON body containing the fields '"action":"create"', '"script":', and '"node":'. ↗
• → Monitor for Shodan/FOFA-exposed Apache APISIX dashboard instances as likely targets; attacker reconnaissance may precede exploitation. ↗
• → The malicious route payload embeds a Lua script using 'io.popen' to execute arbitrary OS commands passed via the 'cmd' URI argument; inspect Admin API POST bodies for 'io.popen' or 'ngx.req.get_uri_args' in the 'script' field. ↗

• · The vulnerability requires the Admin API to be exposed (IP restriction rules deleted or absent). Instances with properly enforced IP allowlists on the Admin API are not directly exploitable via this default token. ↗
• · The Metasploit module also leverages a secondary vulnerability to bypass the IP restriction plugin, meaning even partially hardened instances may be at risk. ↗
• · The 'script' parameter enabling LUA code execution was added in the 2.x version; the CVE formally covers versions 1.2–1.5, but the RCE vector via 'script' applies to 2.x as well. ↗

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.