Apache APISIX Dashboard <2.10.1 - API Unauthorized Access

criticalseverity

9.8CVSS score

86.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin.' While all APIs and authentication middleware are developed based on framework `droplet`, some API directly use the interface of framework `gin` thus bypassing their authentication.

Impact

An attacker can gain unauthorized access to the API, potentially leading to data breaches or unauthorized actions.

Fix

Upgrade to release 2.10.1 or later. Or, change the default username and password, and restrict the source IP to access the Apache APISIX Dashboard.

How to confirm it

Send: GET {{RootURL}}/apisix/admin/migrate/export
Positive when: contains "\"Consumers\":" AND status 200

Run it with nuclei: nuclei -id CVE-2021-45232 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-45232

info:
  name: Apache APISIX Dashboard <2.10.1 - API Unauthorized Access
  author: Mr-xn
  severity: critical
  description: In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin.' While all APIs and authentication middleware are developed based on framework `droplet`,  some API directly use the interface of framework `gin` thus bypassing their authentication.
  impact: |
    An attacker can gain unauthorized access to the API, potentially leading to data breaches or unauthorized actions.
  remediation: Upgrade to release 2.10.1 or later. Or, change the default username and password, and restrict the source IP to access the Apache APISIX Dashboard.
  reference:
    - https://apisix.apache.org/zh/blog/2021/12/28/dashboard-cve-2021-45232/
    - https://github.com/pingpongcult/CVE-2021-45232
    - https://github.com/advisories/GHSA-wcxq-f256-53xp
    - https://twitter.com/403Timeout/status/1475715079173976066
    - https://github.com/wuppp/cve-2021-45232-exp
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-45232
    cwe-id: CWE-306
    epss-score: 0.86327
    epss-percentile: 0.99736
    cpe: cpe:2.3:a:apache:apisix_dashboard:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: apisix_dashboard
  tags: cve2021,cve,apache,unauth,apisix,vuln

http:
  - method: GET
    path:
      - "{{RootURL}}/apisix/admin/migrate/export"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"Consumers":'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from