Description
Apache Apisix是美国阿帕奇（Apache）基金会的一个云原生的微服务API网关服务。该软件基于 OpenResty 和 etcd 来实现，具备动态路由和插件热加载，适合微服务体系下的 API 管理。 Apache APISIX 存在命令注入漏洞，该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。
Apache Apisix 命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://stack.chaitin.com/vuldb/detail/f9f11eb2-6917-43c3-93a0-ad1c5859513e
https://avd.aliyun.com/product?prod=apisix
https://apisix.apache.org/zh/blog/2021/06/17/apache-apisix-dashboard-access-control-bypass-vulnerability-announcement/
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/iot/Apache-APISIX-Dashboard-API%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87%E5%AF%BC%E8%87%B4RCE-CVE-2021-45232.md
https://www.extrahop.com/resources/detections/cve-2022-24112-apache-apisix-exploit-attempt
http://www.aqtd.com/nd.jsp?id=3572
https://cloud.tencent.com/developer/article/2369797
https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/apache-apisix-in-the-wild-exploitations-an-api-gateway-security-study
https://www.h3c.com/cn/d_202207/1644554_30003_0.htm
https://zone.ci/aliyun/ali_nvd/78539.html
https://nvd.nist.gov/vuln/detail/CVE-2022-24112
https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/cve-2022-24112-apache-apisix-remote-code-execution-vulnerability
https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff
https://www.exploit-db.com/exploits/50829