CVE-2020-13945: Apache APISIX Admin API Access IP Restriction Bypass
Summary
CVE-2020-13945: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Affects apisix versions >= 1.2.0, < 1.5.1. Fixed in 1.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache APISIX is an open-source API gateway that provides dynamic routing, rate limiting, and load balancing functionalities. It allows users to manage APIs and configure various policies to control traffic. The Admin API is a feature that enables users to perform administrative tasks programmatically. However, a vulnerability in versions 1.2 to 1.5 of Apache APISIX allows the bypass of IP restriction rules for the Admin API, granting unauthorized access to management data.
Vulnerability Detail
The vulnerability arises when the user enables the Admin API and subsequently deletes the IP restriction rules. This action allows the default token to access APISIX management data without any IP-based restrictions. An attacker who obtains the default token can exploit this vulnerability to perform unauthorized actions, potentially compromising the integrity and confidentiality of the system. The impact of this vulnerability can be significant, as it allows unauthorized access to sensitive management data.
How To Fix
Minimum fixed version
1.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to address the issue effectively.
Conclusion
The CVE-2020-13945 vulnerability in Apache APISIX allows the bypass of IP restriction rules for the Admin API, granting unauthorized access to management data. Users should upgrade to version 1.5.0 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apisix →
FAQ
Apache APISIX is an open-source API gateway that provides dynamic routing, rate limiting, and load balancing functionalities.
The Admin API is a feature in Apache APISIX that allows users to perform administrative tasks programmatically.
The vulnerability occurs when the user enables the Admin API and deletes the IP restriction rules, allowing the default token unrestricted access to APISIX management data.
This vulnerability allows unauthorized access to APISIX management data, potentially compromising the integrity and confidentiality of the system.
To fix this vulnerability, it is recommended to upgrade to Apache APISIX version 1.5.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for apisix.
