{"id":"CVE-2022-24112","published":"2022-02-11T13:15:08Z","modified":"2026-06-17T04:31:18Z","title":"Apache APISIX Authentication Bypass Vulnerability","vendor":"Apache","product":"APISIX","tier":"core","eol":null,"description":{"text":"An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.","provenance":"source","from":"NVD"},"summary":{"text":"Apache APISIX has an authentication bypass flaw in its batch-requests plugin, which allows the IP restriction on the Admin API (and, at reduced impact, the data panel) to be circumvented because a bug lets the plugin's client-IP override check be defeated. An unauthenticated remote attacker can exploit it with no user interaction, and the default configuration with the default API key is reported as leading to remote code execution, while changing the admin key or moving the Admin API to a different port lowers the impact.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:29Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.96069,"percentile":0.99876,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-08-25","dueDate":"2022-09-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94;  https://nvd.nist.gov/vuln/detail/CVE-2022-24112","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-08-19","exploitedFirstSeen":"2022-08-19","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/","date":"2022-08-19"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-08-25"},{"url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-279a","date":"2022-10-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-29&host_type=src&vulnerability=cve-2022-24112","date":"2023-11-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2022-24112","date":"2023-12-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-06&host_type=src&vulnerability=cve-2022-24112","date":"2023-12-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-08&host_type=src&vulnerability=cve-2022-24112","date":"2023-12-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-09&host_type=src&vulnerability=cve-2022-24112","date":"2023-12-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-13&host_type=src&vulnerability=cve-2022-24112","date":"2023-12-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-30&host_type=src&vulnerability=cve-2022-24112","date":"2023-12-30"}],"evidenceTotal":737,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-290","name":"Authentication Bypass by Spoofing"}],"references":[{"url":"http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2022/02/11/3","tags":["Mailing List","Mitigation","Third Party Advisory"]},{"url":"https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94","tags":["Mailing List","Mitigation","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2022/02/11/3","tags":["Mailing List","Mitigation","Third Party Advisory"]},{"url":"https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94","tags":["Mailing List","Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24112","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote exploitation of public-facing gateway plugin","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An attacker can abuse the batch-requests plugin to send requests","start":0,"end":64}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Yields remote code execution on the server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution","start":108,"end":210}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-29024","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29024","exploited":true,"exploitedSince":"2022-08-25","provenance":"source"},"exploits":[{"id":50829,"url":"https://www.exploit-db.com/exploits/50829","title":"Apache APISIX 2.12.1 - Remote Code Execution (RCE)","type":"remote","platform":"multiple","date":"2022-03-16","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-03-16"},"pocGithub":{"count":9,"skipped":1,"earliest":"2022-02-22","earliestUrl":"https://github.com/Mr-xn/CVE-2022-24112","repos":[{"name":"Mr-xn/CVE-2022-24112","url":"https://github.com/Mr-xn/CVE-2022-24112","stars":43,"created":"2022-02-22"},{"name":"M4xSec/Apache-APISIX-CVE-2022-24112","url":"https://github.com/M4xSec/Apache-APISIX-CVE-2022-24112","stars":15,"created":"2022-03-16"},{"name":"twseptian/cve-2022-24112","url":"https://github.com/twseptian/cve-2022-24112","stars":9,"created":"2022-03-20"},{"name":"SecNN/CVE-2022-24112","url":"https://github.com/SecNN/CVE-2022-24112","stars":8,"created":"2022-02-25"},{"name":"Mah1ndra/CVE-2022-24112","url":"https://github.com/Mah1ndra/CVE-2022-24112","stars":7,"created":"2022-03-08"}]},"metasploit":[{"name":"APISIX Admin API default access token RCE","module":"exploit/multi/http/apache_apisix_api_default_token_rce","type":"exploit","disclosureDate":"2020-12-07","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_apisix_api_default_token_rce.rb"}],"nuclei":[{"id":"CVE-2022-24112","name":"Apache APISIX - Remote Code Execution","severity":"critical","path":"http/cves/2022/CVE-2022-24112.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24112.yaml"}],"first":{"date":"2020-12-07","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_apisix_api_default_token_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html","http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-12-07","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-02-22, Exploit-DB 2022-03-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_apisix_api_default_token_rce.rb","provenance":"source"},{"date":"2022-02-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24112","provenance":"source"},{"date":"2022-08-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/","provenance":"source"},{"date":"2022-08-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-08-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-29024","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":195},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1534 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9988"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 9 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}