CVE-2021-43557

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.
References
Link Resource
https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h Exploit Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/11/22/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/11/22/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/11/23/1 Exploit Mailing List Third Party Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*

Information

Published : 2021-11-22 01:15

Updated : 2021-11-26 07:47


NVD link : CVE-2021-43557

Mitre link : CVE-2021-43557


JSON object : View

CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Advertisement

dedicated server usa

Products Affected

apache

  • apisix