CVE-2022-24112

Deeper analysis

Apache APISIX contains a flaw in its batch-requests plugin that fails to enforce an intended check overriding the client IP with the real remote IP address. This allows an attacker to spoof requests and bypass IP-based access controls on the Admin API. The issue affects default installations that use the built-in API key and expose the Admin API on the same port as the data plane, resulting in a CVSS 9.8 remote code execution vector; changing the admin key or moving the Admin API to a separate port reduces but does not eliminate the risk of IP restriction bypass.

Unauthenticated remote attackers can send crafted batch requests that reach administrative endpoints despite configured IP allow-lists. In the default configuration this leads directly to arbitrary code execution on the gateway; even after key or port changes, an attacker who can reach the data plane can still abuse the same plugin logic to circumvent IP restrictions and perform privileged operations.

Public advisories and exploit disclosures, including the Apache OSS-Security list and multiple Packet Storm entries, highlight that the root cause is an incomplete IP-verification check inside the batch-requests plugin. Recommended mitigations center on disabling the plugin when not required, enforcing a non-default admin key, and ensuring the Admin API listens on a distinct, firewalled port from the data plane.

The CVE maintains an extremely high EPSS score with a recorded peak of 0.9744, indicating sustained exploitation interest following disclosure. Public proof-of-concept code has been available since February 2022.