HackZoneLabs News
Newsletter

CVE-2022-24112

apisix/batch-requests plugin allows overwriting the X-REAL-IP header

  • Critical 9.8
  • Exploited: added to CISA KEV 25 Aug 2022

Description

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

Key facts

Published
11 Feb 2022
Last changed
21 Oct 2025
Assigned by
apache
KEV added
25 Aug 2022
KEV fix due
15 Sep 2022
EPSS
96.069% likely to be exploited in the next 30 days, higher than 99.878% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: yes; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 9.8CVSS 3.1, Criticalfrom CISA (ADP container)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What to do

  • 1. explicitly configure the enabled plugins in `conf/config.yaml`, ensure `batch-requests` is disabled. (Or just comment out `batch-requests` in `conf/config-default.yaml`) Or 1. upgrade to 2.10.4 or 2.12.1.CNA workaround statement
  • Apply updates per vendor instructions.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
Apache Software FoundationApache APISIX
  • Apache APISIX 2.12 up to but excluding 2.12.1 (affected)
  • Apache APISIX 2.10 up to but excluding 2.10.4 (affected)
  • 1.3 up to but excluding Apache APISIX 1* (affected)

Timeline

  1. 11 Feb 2022 Published
  2. 25 Aug 2022 CVE-2022-24112 added to CISA KEV
  3. 25 Aug 2022 Added to the CISA KEV catalogue

Weakness

References