CVE-2022-24112
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
- Record
CVE-2022-24112- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-290
- Updated
- 2026-11-02
CVE List
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
- Record
CVE-2022-24112- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-290
- Updated
- 2026-11-02
EUVDEUVD-2022-29024
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
- Record
EUVD-2022-29024- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2vc7-6w39-6rh2
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of...
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
- Record
GHSA-2vc7-6w39-6rh2- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-290
- Updated
- 2026-11-02
CISA KEV No score
Apache APISIX Authentication Bypass Vulnerability
Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.
- Record
CVE-2022-24112- Weakness
- CWE-290
- Updated
- 2026-11-02
OSV
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
- Record
CVE-2022-24112- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-290
- Updated
- 2026-11-02
OSVBIT-apisix-2022-24112 No score
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
- Record
BIT-apisix-2022-24112- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apisixBitnami |
before 2.10.4, 2.11.0 up to 2.12.1 | 2.10.42.12.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | APISIX Admin API default access token RCE | 2020-12-07 |
| PoC in GitHub | CrackerCat/CVE-2022-24112 | 2022-02-22 |
| PoC in GitHub | Mr-xn/CVE-2022-24112 | 2022-02-22 |
| PoC in GitHub | SecNN/CVE-2022-24112 | 2022-02-25 |
| PoC in GitHub | Mah1ndra/CVE-2022-24112 | 2022-03-08 |
| Exploit-DB | Apache APISIX 2.12.1 - Remote Code Execution (RCE) | 2022-03-16 |
| PoC in GitHub | kavishkagihan/CVE-2022-24112-POC | 2022-03-17 |
| PoC in GitHub | twseptian/cve-2022-24112 | 2022-03-20 |
| PoC in GitHub | Acczdy/CVE-2022-24112_POC | 2022-12-03 |
| PoC in GitHub | btar1gan/exploit_CVE-2022-24112 | 2024-06-03 |
| PoC in GitHub | fatkz/CVE-2022-24112 | 2025-05-23 |
| Nuclei | Apache APISIX - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits | PoC in GitHub | |
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24112 is a critical vulnerability (CVSS 9.8) in Apache Apisix, published February 11, 2022. CISA lists it as known to be exploited, since August 25, 2022. EUVD reports exploitation since August 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.1%, the 99th percentile. Fixed in apisix 2.10.4.
References
lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94
openwall.com/lists/oss-security/2022/02/11/3
packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24112
nvd.nist.gov/vuln/detail/CVE-2022-24112
github.com/advisories/GHSA-2vc7-6w39-6rh2