RCE via IP Restriction Bypass in Apache APISIX batch-requests Plugin

This repository contains a Python proof-of-concept exploit (exploit.py) targeting a remote code execution vulnerability in Apache APISIX versions 2.12.0 and 2.12.1. The exploit abuses the admin API's 'filter_func' Lua field to inject arbitrary Lua code, which is used to execute system commands on the server via io.popen. The exploit works by sending a crafted HTTP POST request to the /apisix/batch-requests endpoint, injecting a new route with the malicious filter_func. The attacker then triggers this route via a GET request to /rms/fzxewh, causing the server to execute the supplied command and return its output. The exploit requires the admin API to be accessible and the default API key to be valid. The repository consists of a single exploit script and a README with usage instructions. No detection or fake code is present; the exploit is functional and demonstrates the vulnerability.

This repository contains a single Metasploit module targeting Apache APISIX's admin API. The exploit leverages the default API token (edd1c9f034335f136f87ad84b625c8f1) to authenticate and interact with the admin API, exploiting two CVEs (CVE-2020-13945 and CVE-2022-24112). The module can bypass IP restrictions using the batch-requests plugin and achieves remote code execution by injecting Lua code via the 'script' or 'filter_func' parameters in route definitions. The default payload is a Unix reverse shell, but any Metasploit-compatible payload can be used. The module is operational and weaponized, providing reliable RCE against vulnerable APISIX deployments. The main endpoints targeted are '/apisix/admin/routes' and '/apisix/batch-requests'. The code is well-structured, with clear separation of checking, exploitation, and cleanup logic, and is intended for use within the Metasploit framework.

This repository contains a proof-of-concept exploit (poc.py) for CVE-2022-24112, a remote code execution vulnerability in Apache APISIX versions 1.3 through 2.12.1. The exploit abuses the default admin API key and an IP restriction bypass to inject a malicious route via the /apisix/batch-requests endpoint. The injected route contains a Lua filter function that executes a bash reverse shell, connecting back to an attacker-controlled host and port (lhost:lport). The exploit is operational, requiring the attacker to provide the target URL, their own host, and port for the reverse shell. The README provides a brief description and a link to a full walkthrough. The main code file is poc.py, written in Python, and the exploit is not part of a larger framework. The exploit targets network-exposed APISIX admin APIs with default credentials and demonstrates a practical remote code execution scenario.

This repository contains a Python exploit script (apisix-exploit.py) targeting Apache APISIX instances vulnerable to CVE-2022-24112. The exploit abuses the batch-requests plugin and a misconfiguration in the Admin API (default API key and accessible port) to achieve remote code execution. The script sends a crafted batch request to the /apisix/batch-requests endpoint, creating a new route with a malicious filter_func that executes a reverse shell payload via os.execute in Lua. The attacker must supply the target URL, their own host, and port for the reverse shell. The exploit then triggers the payload by accessing the newly created route. The repository also includes a README.md that explains the vulnerability, its impact, and remediation steps. The exploit is operational and provides a working reverse shell if the target is vulnerable and misconfigured.

This repository provides a working exploit for CVE-2022-24112, a remote code execution vulnerability in Apache APISIX. The exploit consists of two Python scripts: - 50829_1.py: Sends a crafted POST request to the APISIX admin API, injecting a new route with a malicious Lua filter function. This function executes a bash reverse shell, connecting back to the attacker's machine (192.168.45.175:1234). - 50829_2.py: Triggers the injected route via a GET request, causing the malicious code to execute and establish the reverse shell. The exploit targets APISIX instances with exposed and unprotected admin APIs. The payload is a reverse shell, and the scripts are operational, requiring only minor modifications (such as target and attacker IPs) to use in a real attack. The repository is structured simply, with clear separation between the injection and trigger phases, and includes a README with basic usage instructions.

This repository contains two Python exploit scripts targeting CVE-2022-24112, a remote code execution vulnerability in Apache APISIX versions 1.3 through 2.12.1. The vulnerability arises from insufficient restrictions in the batch-requests plugin, allowing attackers to bypass Admin API IP restrictions and inject routes with malicious Lua code. Both scripts (one for Linux, one for Windows) automate the exploitation process: they send a crafted POST request to the '/apisix/batch-requests' endpoint to create a new route with a filter_func that executes a reverse shell payload. The payload connects back to an attacker-controlled host and port, granting remote shell access. The exploit then triggers the payload by sending a GET request to the newly created route ('/rms/fzxewh'). The repository also includes a README.md with usage instructions and background on the vulnerability. The scripts require the attacker to provide the target's address, their own host, and port for the reverse shell. The exploit is operational and provides a working reverse shell if the target is vulnerable and accessible.