k3ystr0k3r/cve-2020-13945-exploitA PoC exploit for CVE-2020-13945 - Apache APISIX Remote Code Execution (RCE)
This repository contains a proof-of-concept (PoC) exploit for a vulnerability in Apache APISIX. The vulnerability arises when the Admin API is enabled and the access IP restriction rules are deleted, allowing the default token to access APISIX management data. This affects versions 1.2, 1.3, 1.4, and 1.5.
Apache APISIX is a dynamic, real-time, high-performance API gateway. A critical security vulnerability exists in versions 1.2 to 1.5, where enabling the Admin API and deleting the Admin API access IP restriction rules permits unauthorized access using the default token.
Clone the repository:
git https://github.com/K3ysTr0K3R/CVE-2020-13945-EXPLOIT.git
cd CVE-2020-13945
Install dependencies:
pip install -r requirements.txt
python CVE-2020-13945.py -u <target>
python CVE-2020-13945.py -f <target_file> -t 77
<target(s)> with the url of the target APISIX instance to exploit.To mitigate this vulnerability:
For detailed information on configuring security settings, refer to the Apache APISIX documentation.
This PoC exploit is intended for educational purposes only. Use it at your own risk. Unauthorized use of this tool against systems without explicit permission is illegal and unethical. The author is not responsible for any damage caused by the use of this exploit.