CVE-2021-43557
HighPublished
Path traversal in request_uri variable
- Published
- Nov 22, 2021
- Updated
- Aug 4, 2024
- Assigning CNA
- apache
- Evidence observed
- Aug 5, 2026
Primary CVSS
7.5/ 10High
Loading vulnerability catalog
Path traversal in request_uri variable
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NModerate · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.
PoC for CVE-2021-43557
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.