Read the docs
TI-2022-08057 Aliases CVE-2022-24112GHSA-2vc7-6w39-6rh2

apisix/batch-requests plugin allows overwriting the X-REAL-IP header

Priority CRITICAL 100Exploited in the wildCWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-290.

Summary

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

Why it matters now

Exploitation Active In CISA KEV since 2022-08-25CISA due date 2022-09-15
EPSS 0.96069 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Apache APISIX (Apache Software Foundation): 2.12.1, 2.10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache APISIXApache APISIX 2.12 to before 2.12.1; Apache APISIX 2.10 to before 2.10.4; 1.3 and later2.12.1, 2.10.4Patch availableCNA
  • Apache APISIX VendorApache Affected Apache APISIX 2.12 to before 2.12.1; Apache APISIX 2.10 to before 2.10.4; 1.3 and later Fixed in 2.12.1, 2.10.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*before 2.10.4; 2.11.0 to before 2.12.1VulnerableApache
  • cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:* Versions before 2.10.4; 2.11.0 to before 2.12.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache APISIX (Apache Software Foundation) Fixed in 2.12.1, 2.10.4

Timeline

  1. 2022-08-25 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2022-24112
  3. 2026-10-03 Alias added: GHSA-2vc7-6w39-6rh2

References

Exploit 2

Advisory 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2020-10921 In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP… CVSS 3.1MEDIUM 6.5
  • TI-2026-24457 Apache APISIX: forward auth plugin allows header injection CVSS 3.1CRITICAL 9.1
  • TI-2022-09331 Apache APISIX: the body_schema check in request-validation plugin can be bypassed CVSS 3.1CRITICAL 9.8
  • TI-2021-19447 Path traversal in request_uri variable CVSS 3.1HIGH 7.5
  • TI-2026-52703 Apache APISIX: Unauthenticated CPU-exhaustion DoS CVSS 4.0HIGH 8.7
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences