CVE-2022-24112 PoC — apisix/batch-requests plugin allows overwriting the X-REAL-IP header

Source

https://github.com/fatkz/CVE-2022-24112

Associated Vulnerability

Title: apisix/batch-requests plugin allows overwriting the X-REAL-IP header (CVE-2022-24112)
Description:An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

Readme

# Apache APISIX 2.12.x Remote Code Execution (RCE) Exploit

This Python script is a Proof-of-Concept (PoC) for a remote code execution (RCE) vulnerability in Apache APISIX versions 2.12.0 and 2.12.1.

The vulnerability lies in the misuse of the `filter_func` Lua field within the admin API, allowing an attacker to inject arbitrary Lua code that executes system commands via `io.popen`. The response from the command is returned in the HTTP response using `ngx.say()`.

> ⚠️ **DISCLAIMER**: This tool is intended for authorized testing and educational purposes only. Do not use it on systems you do not own or have explicit permission to test.

---

## 🧰 Requirements

- Python 3.6+
- `requests` library (`pip install requests`)

---

## 🚀 Usage

### 📁 File Name
`exploit.py`

### 🔧 Syntax

```bash
python3 exploit.py -d <target_domain_or_ip> -p <port> -c <command>
```
```bash
python3 exploit.py -d 127.0.0.1 -p 9080 -c id
python3 exploit.py --domain 192.168.1.100 --cmd "uname -a"
python3 exploit.py -d vulnerable.host.local -c "cat /etc/passwd"
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →