CVE-2021-45232 security vulnerability on unauthorized access.
Attackers can bypass authentication in Apache APISIX Dashboard by accessing APIs that incorrectly bypass the security middleware, leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-45232?
CVE-2021-45232 is a critical missing authorization vulnerability in Apache APISIX Dashboard, published on 27 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.
Weakness: CWE-306
Which versions are affected by CVE-2021-45232?
1 open source package ship an affected version, including apisix_dashboard. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apisix_dashboard Bitnami | All versions | 2.10.1 |
Products include Apache Apisix Dashboard.
How do I fix CVE-2021-45232?
Upgrade apisix_dashboard to 2.10.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-45232 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-45232 exists.
Public exploit code: 1 Nuclei template and 11 proofs of concept on GitHub.
Other vulnerabilities in Apache APISIX Dashboard
Sources
Also known as BIT-apisix_dashboard-2021-45232, GHSA-wcxq-f256-53xp.