{"id":"CVE-2022-24112","aliases":["BIT-apisix-2022-24112","EUVD-2022-29024","GHSA-2vc7-6w39-6rh2"],"status":"published","title":"apisix/batch-requests plugin allows overwriting the X-REAL-IP header","description":"An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.96069,"percentile":0.99877,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-290"],"published":"2022-02-11T12:20:13Z","modified":"2026-10-28T02:30:46Z","kev":{"date_added":"2022-08-25","due_date":"2022-09-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-08-25"},{"source":"kev","since":"2022-08-25"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/apache_apisix_api_default_token_rce","title":"APISIX Admin API default access token RCE","type":"exploit","platform":"Unix","date":"2020-12-07","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/apache_apisix_api_default_token_rce"},{"source":"pocgithub","id":"CrackerCat/CVE-2022-24112","title":"CrackerCat/CVE-2022-24112","date":"2022-02-22","url":"https://github.com/CrackerCat/CVE-2022-24112"},{"source":"pocgithub","id":"Mr-xn/CVE-2022-24112","title":"Mr-xn/CVE-2022-24112","date":"2022-02-22","url":"https://github.com/Mr-xn/CVE-2022-24112"},{"source":"pocgithub","id":"SecNN/CVE-2022-24112","title":"SecNN/CVE-2022-24112","date":"2022-02-25","url":"https://github.com/SecNN/CVE-2022-24112"},{"source":"pocgithub","id":"Mah1ndra/CVE-2022-24112","title":"Mah1ndra/CVE-2022-24112","date":"2022-03-08","url":"https://github.com/Mah1ndra/CVE-2022-24112"},{"source":"exploitdb","id":"EDB-50829","title":"Apache APISIX 2.12.1 - Remote Code Execution (RCE)","type":"remote","platform":"multiple","date":"2022-03-16","url":"https://www.exploit-db.com/exploits/50829"},{"source":"pocgithub","id":"kavishkagihan/CVE-2022-24112-POC","title":"kavishkagihan/CVE-2022-24112-POC","date":"2022-03-17","url":"https://github.com/kavishkagihan/CVE-2022-24112-POC"},{"source":"pocgithub","id":"twseptian/cve-2022-24112","title":"twseptian/cve-2022-24112","date":"2022-03-20","url":"https://github.com/twseptian/cve-2022-24112"},{"source":"pocgithub","id":"Acczdy/CVE-2022-24112_POC","title":"Acczdy/CVE-2022-24112_POC","date":"2022-12-03","url":"https://github.com/Acczdy/CVE-2022-24112_POC"},{"source":"pocgithub","id":"btar1gan/exploit_CVE-2022-24112","title":"btar1gan/exploit_CVE-2022-24112","date":"2024-06-03","url":"https://github.com/btar1gan/exploit_CVE-2022-24112"},{"source":"pocgithub","id":"fatkz/CVE-2022-24112","title":"fatkz/CVE-2022-24112","date":"2025-05-23","url":"https://github.com/fatkz/CVE-2022-24112"},{"source":"nuclei","id":"CVE-2022-24112","title":"Apache APISIX - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24112.yaml"}],"fixes":[{"ecosystem":"Bitnami","package":"apisix","fixed_in":["2.10.4","2.12.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"apisix","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.10.4"},{"introduced":"2.11.0"},{"fixed":"2.12.1"}]}]}],"products":[{"vendor":"apache","product":"apisix"},{"vendor":"apache software foundation","product":"apache apisix"}],"references":[{"url":"https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94","tags":["x_refsource_MISC","x_transferred","Mailing List","Mitigation","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/02/11/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Mitigation","Third Party Advisory","advisory","article"]},{"url":"http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24112","tags":["government-resource","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24112","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2vc7-6w39-6rh2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24112.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-24112","title":"apisix/batch-requests plugin allows overwriting the X-REAL-IP header","description":"An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.","status":"published","published":"2022-02-11T12:20:13Z","modified":"2025-10-21T23:15:46.674Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-29024","description":"An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.","status":"published","published":"2022-02-11T12:20:13Z","modified":"2025-10-21T23:15:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-08-25","updated_at":"2026-11-02T20:31:25.901288Z"}],"ghsa":[{"id":"GHSA-2vc7-6w39-6rh2","title":"An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of...","description":"An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.","status":"published","published":"2022-02-12T00:00:48Z","modified":"2025-10-22T00:32:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:04:05.344883Z"}],"kev":[{"id":"CVE-2022-24112","title":"Apache APISIX Authentication Bypass Vulnerability","description":"Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.","cwes":["CWE-290"],"kev":{"date_added":"2022-08-25","due_date":"2022-09-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-24112","description":"An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.","status":"published","published":"2022-02-11T13:15:08.073Z","modified":"2026-06-17T04:31:18.883Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:07:12.155838Z"}],"osv":[{"id":"CVE-2022-24112","title":"apisix/batch-requests plugin allows overwriting the X-REAL-IP header","description":"An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.","status":"published","published":"2022-02-11T12:20:13Z","modified":"2026-10-28T02:30:46.510045707Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"BIT-apisix-2022-24112","title":"apisix/batch-requests plugin allows overwriting the X-REAL-IP header","description":"An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.","status":"published","published":"2024-03-06T10:51:05.969Z","modified":"2026-09-08T08:45:33.77950935Z","updated_at":"2026-11-02T15:28:28.267217Z"}]}}