exploit/multi/http/apache_apisix_api_default_token_rce

weaponized

APISIX Admin API default access token RCE

view exploit source metasploittype exploitpublished 2020-12-07catalog metasploit

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2022-24112US	critical9.8OT critical	96.1% (100th)	KEV	2022-02-11
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulne…
CVE-2020-13945US	medium6.5	73.0% (99th)	Exploit	2020-12-07
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. T…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.