The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.
References
Link | Resource |
---|---|
https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h | Exploit Mailing List Vendor Advisory |
http://www.openwall.com/lists/oss-security/2021/11/22/2 | Mailing List Third Party Advisory |
http://www.openwall.com/lists/oss-security/2021/11/22/1 | Mailing List Third Party Advisory |
http://www.openwall.com/lists/oss-security/2021/11/23/1 | Exploit Mailing List Third Party Advisory |
Configurations
Information
Published : 2021-11-22 01:15
Updated : 2021-11-26 07:47
NVD link : CVE-2021-43557
Mitre link : CVE-2021-43557
JSON object : View
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Products Affected
apache
- apisix