CVE-2021-45232 PoC — security vulnerability on unauthorized access.

Source

Associated Vulnerability

Title: security vulnerability on unauthorized access. (CVE-2021-45232)
Description:In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.

Description

Apisix系列漏洞：未授权漏洞（CVE-2021-45232）、默认秘钥（CVE-2020-13945）批量探测。

Readme

# Apisix_Crack
## 概述
Apisix系列漏洞探测利用工具，包括未授权访问漏洞（CVE-2021-45232）和默认秘钥漏洞（CVE-2020-13945），支持批量探测利用。
## 使用方法
批量探测：文件中逐行写入需要检测的URL，参数-TF 指定文件 -t 并发数量

单个目标探测：-T http://x.x.x.x
## 执行效果
![image](https://user-images.githubusercontent.com/41934714/167410312-ff1aae77-c578-45d7-8726-c56a35cf9ed6.png)
![image](https://user-images.githubusercontent.com/41934714/167410398-9fb1abdb-37de-4fad-ba2d-dffaab5a5e93.png)

##### 玉兔安全致力于web安全、红蓝对抗、内网渗透、免杀技巧、安全工具系列干货分享。更多安全工具分享，欢迎关注玉兔安全公众号！
![image](https://user-images.githubusercontent.com/41934714/157003667-2745fd4b-950f-4b1f-8c9f-28b30e46c9b3.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →