Improper Authentication in Apache APISIX - CVE-2021-45232
Published: December 27, 2021 / Updated: September 4, 2022
Vulnerability identifier: #VU59095
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-45232
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in the Manager API. A remote attacker can bypass authentication process and gain unauthorized access to the application via certain API endpoints, that use directly "gin" framework instead of "droplet" framework.
Affected software
Apache APISIX
How to mitigate CVE-2021-45232
Install updates from vendor's website.
Apache APISIX - update to 2.10.1
Links to Public Exploits and PoC-codes
- Exploit #8338 - CVE-2021-45232 (CVE-2021-45232 POC) (September 4, 2022)
- Exploit #7794 - Apisix_Crack (Apisix系列漏洞：未授权漏洞（CVE-2021-45232）、默认秘钥（CVE-2020-13945）批量探测。) (May 12, 2022)
- Exploit #7227 - CVE-2021-45232-RCE (CVE-2021-45232-RCE) (January 7, 2022)
- Exploit #7226 - CVE-2021-45232-RCE (CVE-2021-45232-RCE-多线程批量漏洞检测) (January 6, 2022)
- Exploit #7218 - cve-2021-45232-rce () (December 30, 2021)
- Exploit #7217 - cve-2021-45232-exp () (December 30, 2021)
- Exploit #7214 - CVE-2021-45232 (CVE-2021-45232 POC) (December 29, 2021)
- Exploit #7213 - cve-2021-45232 () (December 29, 2021)
- Exploit #7210 - CVE-2021-45232-RCE (CVE-2021-45232 RCE) (December 28, 2021)
- Exploit #7209 - CVE-2021-45232 (CVE-2021-45232) (December 28, 2021)