CVE-2022-24112 Apache APISIX Authentication Bypass
Attackers can bypass IP restrictions on the Admin API via the batch-requests plugin, potentially leading to remote code execution in default configurations.
- Exploited in the wild
- Since 25 Aug 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24112?
CVE-2022-24112 is a critical authentication bypass vulnerability in Apache APISIX, published on 11 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Weakness: CWE-290
Which versions are affected by CVE-2022-24112?
1 open source package ship an affected version, including apisix. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apisix Bitnami | All versions | 2.10.4, 2.12.1 |
Products include Apache Apisix.
How do I fix CVE-2022-24112?
Upgrade apisix to a fixed version for your release line: 2.10.4 or 2.12.1. US federal agencies must fix it by 15 Sep 2022.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-24112 being exploited?
Yes. Attackers have exploited CVE-2022-24112 in the wild since at least 25 Aug 2022.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 10 proofs of concept on GitHub.
Other vulnerabilities in Apache APISIX
- CVE-2022-25757 Apache APISIX: the body_schema check in request-validation plugin can be bypassed
- CVE-2026-31908 Apache APISIX: forward auth plugin allows header injection
- CVE-2026-75005 Apache APISIX: Unauthenticated CPU-exhaustion DoS
- CVE-2025-27446 Privilege escalation in Apache APISIX Java Plugin Runner
- CVE-2026-31923 Apache APISIX: Openid-connect `tls_verify` field is disabled by default
Sources
Also known as BIT-apisix-2022-24112, GHSA-2vc7-6w39-6rh2.