CVE-2022-24112
published 2022-02-11CVE-2022-24112: An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with…
PriorityP198critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-09-15
Exploited in the wild
EPSS
96.18%
99.9th percentile
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | apisix | < 2.10.4 | 2.10.4 |
| apache | apisix | >= 2.11.0 < 2.12.1 | 2.12.1 |
| apache_software_foundation | apache_apisix | >= 1.3 < Apache APISIX 1* | Apache APISIX 1* |
| apache_software_foundation | apache_apisix | >= Apache APISIX 2.10 < 2.10.4 | 2.10.4 |
| apache_software_foundation | apache_apisix | >= Apache APISIX 2.12 < 2.12.1 | 2.12.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit chain requires two HTTP requests: (1) POST to /apisix/batch-requests with X-Real-IP: 127.0.0.1 header and api_key in pipeline path to bypass IP restriction, then (2) GET to the newly created route to trigger the filter_func RCE payload. ↗
- →The nuclei template confirms exploitation by matching both '"reason":"OK"' and '"status":200' in the batch-requests response body, plus an out-of-band HTTP callback via interactsh.
- →Shodan/FOFA queries can identify exposed Apache APISIX Dashboard instances as pre-exploitation reconnaissance targets.
- →The Snort/ET rule (SID 2035272) fires on POST to /apisix/batch-requests containing both X-Real-IP and api_key=edd1c9f034335f136f87ad84b625c8f1 and filter_func in the request body — all three must be present.
- ·The default API key edd1c9f034335f136f87ad84b625c8f1 is only exploitable if it has NOT been changed from the default. Changing the admin key significantly reduces impact. ↗
- ·Even with a changed admin key or non-default Admin API port, the IP restriction bypass in the batch-requests plugin still poses a risk to the data panel. ↗
- ·Disabling the batch-requests plugin in conf/config.yaml fully mitigates the vulnerability; it should be explicitly removed if not needed.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2vc7-6w39-6rh2: An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API
ghsa_unreviewed·2022-02-12
CVE-2022-24112 [CRITICAL] CWE-290 GHSA-2vc7-6w39-6rh2: An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
VulnCheck
Apache APISIX Authentication Bypass Vulnerability
vulncheck·2022·CVSS 9.8
CVE-2022-24112 [CRITICAL] CWE-290 Apache APISIX Authentication Bypass Vulnerability
Apache APISIX Authentication Bypass Vulnerability
Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.
Affected: Apache APISIX
Required Action: Apply updates per vendor instructions.
Exploitation References: https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.cisa.gov/uscert/ncas/alerts/aa22-279a; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-29&host_type=src&vulnerability=cve-2022-24112; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2022-24112; https://dashboard.shadowserver.org/statistics/honeypot/vulne
CISA
Apache APISIX Authentication Bypass Vulnerability
cisa·2022-08-25·CVSS 9.8
CVE-2022-24112 [CRITICAL] CWE-290 Apache APISIX Authentication Bypass Vulnerability
Vulnerability: Apache APISIX Authentication Bypass Vulnerability
Affected: Apache APISIX
Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94; https://nvd.nist.gov/vuln/detail/CVE-2022-24112
Remediation Due Date: 2022-09-15
Suricata
ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M1
suricata·2022-02-22·CVSS 9.8
CVE-2022-24112 [CRITICAL] ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M1
ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M1
Rule: alert http1 any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M1"; flow:established,to_server; http.request_line; content:"POST /apisix/batch-requests HTTP/1.1"; fast_pattern; http.request_body; content:"X-Real-IP"; nocase; content:"api_key=edd1c9f034335f136f87ad84b625c8f1"; distance:0; content:"filter_func"; reference:cve,2022-24112; classtype:attempted-admin; sid:2035272; rev:4; metadata:created_at 2022_02_22, cve CVE_2022_24112, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_06_23, mitre_tactic_id TA0001, mitre_tactic_na
Suricata
ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M2
suricata·2022-02-22·CVSS 9.8
CVE-2022-24112 [CRITICAL] ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M2
ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M2
Rule: alert http1 any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M2"; flow:established,to_server; http.request_line; content:"POST /apisix/batch-requests HTTP/1.1"; fast_pattern; http.request_body; content:"X-Real-IP"; nocase; content:"api_key=edd1c9f034335f136f87ad84b625c8f1"; distance:0; content:"script"; reference:cve,2022-24112; classtype:attempted-admin; sid:2035273; rev:4; metadata:created_at 2022_02_22, cve CVE_2022_24112, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_06_23, mitre_tactic_id TA0001, mitre_tactic_name In
Exploit-DB
Apache APISIX 2.12.1 - Remote Code Execution (RCE)
exploitdb·2022-03-16·CVSS 9.8
CVE-2022-24112 [CRITICAL] Apache APISIX 2.12.1 - Remote Code Execution (RCE)
Apache APISIX 2.12.1 - Remote Code Execution (RCE)
---
# Exploit Title: Apache APISIX 2.12.1 - Remote Code Execution (RCE)
# Date: 2022-03-16
# Exploit Author: Ven3xy
# Vendor Homepage: https://apisix.apache.org/
# Version: Apache APISIX 1.3 – 2.12.1
# Tested on: CentOS 7
# CVE : CVE-2022-24112
import requests
import sys
class color:
HEADER = '\033[95m'
IMPORTANT = '\33[35m'
NOTICE = '\033[33m'
OKBLUE = '\033[94m'
OKGREEN = '\033[92m'
WARNING = '\033[93m'
RED = '\033[91m'
END = '\033[0m'
UNDERLINE = '\033[4m'
LOGGING = '\33[34m'
color_random=[color.HEADER,color.IMPORTANT,color.NOTICE,color.OKBLUE,color.OKGREEN,color.WARNING,color.RED,color.END,color.UNDERLINE,color.LOGGING]
def banner():
run = color_random[6]+'''\n . ,
_.._ * __*\./ ___ _ \./._ | _ *-+-
(_][_)|_) |/'\ (/,/'\[_)|(_)|
Nuclei
Apache APISIX - Remote Code Execution
nuclei·CVSS 9.8
CVE-2022-24112 [CRITICAL] Apache APISIX - Remote Code Execution
Apache APISIX - Remote Code Execution
A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Template:
id: CVE-2022-24112
info:
name: Apache APISIX - Remote Code Execution
author: Mr-xn
severity: critical
description: A default configuration of Apache APISIX (with
Metasploit
APISIX Admin API default access token RCE
metasploit
APISIX Admin API default access token RCE
APISIX Admin API default access token RCE
Apache APISIX has a default, built-in API token edd1c9f034335f136f87ad84b625c8f1 that can be used to access all of the admin API, which leads to remote LUA code execution through the script parameter added in the 2.x version. This module also leverages another vulnerability to bypass the IP restriction plugin.
Qualys
NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors
blogs_qualys·2022-10-07·CVSS 10.0
[CRITICAL] NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors
## Table of Contents
Detect & Prioritize 20 Publicly Known Vulnerabilities using VMDR 2.0
Identify Vulnerable Assets using Qualys Threat Protection
Recommendations & Mitigations
Contributors
On October 6, 2022, the United States National Security Agency (NSA) released a cybersecurity advisory on the Chinese government—officially known as the People’s Republic of China (PRC) states-sponsored cyber actors’ activity to seek national interests. These malicious cyber activities attributed to the Chinese government targeted, and persist to target, a mixture of industries and organizations in the United States. They provide the top CVEs used since 2020 by the People’s Republic of China (PRC) states-sponsored cyber actors as evaluated by the National Security Agency (NSA), Cybersecurity and I
Qualys
NSA Alert: Topmost CVEs Actively Exploited By PRC Sponsored Cyber Actors | Qualys
blogs_qualys·2022-10-07
NSA Alert: Topmost CVEs Actively Exploited By PRC Sponsored Cyber Actors | Qualys
#### Table of Contents
- Detect & Prioritize 20 Publicly Known Vulnerabilities using VMDR 2.0
- Identify Vulnerable Assets using Qualys Threat Protection
- Recommendations & Mitigations
- Contributors
On October 6, 2022, the United States National Security Agency (NSA) released a cybersecurity advisory on the Chinese government—officially known as the People’s Republic of China (PRC) states-sponsored cyber actors’ activity to seek national interests. These malicious cyber activities attributed to the Chinese government targeted, and persist to target, a mixture of industries and organizations in the United States. They provide the top CVEs used since 2020 by the People’s Republic of China (PRC) states-sponsored cyber actors as evaluated by the National Security Agency (NSA), Cybersecurit
Tenable
Top 20 CVEs Exploited by People's Republic of China State-Sponsored Actors (AA22-279A)
blogs_tenable·2022-10-07
Top 20 CVEs Exploited by People's Republic of China State-Sponsored Actors (AA22-279A)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
blogs_unit42·2022-08-19·CVSS 8.8
CVE-2021-20166 [HIGH] Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
Threat Research Center
Trend Reports
Vulnerabilities
## Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
Yue Guan
Published: August 19, 2022
Trend Reports
Vulnerabilities
Attack analysis
CVE-2021-20166
CVE-2021-20167
CVE-2021-21881
CVE-2021-24762
CVE-2021-28169
CVE-2021-31589
CVE-2021-39226
CVE-2021-4045
CVE-2021-43711
CVE-2022-21371
CVE-2022-21662
CVE-2022-22536
CVE-2022-22947
CVE-2022-22954
CVE-2022-22963
CVE-2022-22965
CVE-2022-24112
CVE-2022-24260
CVE-2022-25060
CVE-2022-25075
CVE-2022-25134
CVE-2022-27226
CVE-2022-29464
Exploit in the wild
Network security trends
## Executive Summary
Recent observations of exploits used in the wild reveal that attackers have been making use
Unit42
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
blogs_unit42·2022-08-19
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
## Executive Summary
Recent observations of exploits used in the wild reveal that attackers have been making use of newly published remote code execution vulnerabilities in VMware ONE Access and Identity Manager and Spring Cloud Function, Spring MVC and Spring Web Flux, among others. Attackers have also been taking advantage of a cross-site scripting vulnerability in WordPress core, and SQL injection vulnerabilities in VoIPmonitor GUI and other services. In our observations of network security trends, Unit 42 researchers select exploits of the latest published attacks that defenders should know based on the availability of proofs of concept (PoCs), the severity of the vulnerabilities the exploits are based on and the ease of exploitation.
Other insights that could assist defenders includ
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
arXiv
CyberSleuth: Autonomous Blue-Team LLM Agent for Web Attack Forensics
arxiv_fulltext·2026-03-05
CyberSleuth: Autonomous Blue-Team LLM Agent for Web Attack Forensics
: Autonomous Blue-Team LLM Agent for Web Attack Forensics
Stefano Fumero
Politecnico di Torino
Kai Huang
Politecnico di Torino
Matteo BoffaCorresponding author: [email protected]
Politecnico di Torino
Danilo Giordano
Politecnico di Torino
Marco Mellia
Politecnico di Torino
Dario Rossi
Huawei Technologies France
## Abstract
Post-mortem analysis of compromised systems is a key aspect of cyber forensics, today a mostly manual, slow, and error-prone task. Agentic AI, i.e., LLM-powered agents, is a promising avenue for automation. However, applying such agents to cybersecurity remains largely unexplored and difficult, as this domain demands long-term reasoning, contextual memory, and consistent evidence correlation -- capabilities that current LLM agents struggle to master.
http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.htmlhttp://www.openwall.com/lists/oss-security/2022/02/11/3https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.htmlhttp://www.openwall.com/lists/oss-security/2022/02/11/3https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24112
2022-02-11
Published
2022-08-25
Added to CISA KEV
Exploited in the wild