CVE-2022-24112

CVE-2022-24112: Apache APISIX apisix/batch-requests RCE

nuclei template: CVE-2022-24112.yaml

The essence of this vulnerability is similar to CVE-2021-45232, both bypass authorization or are unauthenticated, to execute malicious filter_func or script in a route to execute commands.

Notes

• The value of X-Real-IP can be 127.0.0.1, localhost or 2130706433
• pipeline is required, the following is a description of its body field values
• method is fixed to PUT
• uri must exist, this is also the URL that needs to be accessed after exp to trigger