ApiSec: The week of Dec'27th, 2021. Apache APISIX Remote Code Exeution

Apache APISIX Remote Code Execution by API authentication bypass CVE-CVE-2021-45232

Apache APISIX is a cloud-native API gateway https://github.com/apache/apisix driven by an open-source community.

Just a simple API call to the endpoint /apisix/admin/migrate/export allows attackers to download the configuration file and cause Remote Code Exection.

Vulnerable software: Apache APISIX Dashboard < 2.10.1

Look how it's simple:

GET /apisix/admin/migrate/export HTTP/1.1
Host: ...
...        

Source: https://github.com/Ilovewomen/cve-2021-45232