CVE-2020-13945

Description

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache APISIX	1.2, 1.3, 1.4, 1.5	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

APISIX Admin API default access token RCE
exploit/multi/http/apache_apisix_api_default_token_rce

GitHub 2 repositories

YutuSec/Apisix_Crack ★ 8 · May 9, 2022

Apisix系列漏洞：未授权漏洞（CVE-2021-45232）、默认秘钥（CVE-2020-13945）批量探测。
CyberCTF/vulhub-apisix-cve-2020-13945 ★ 0 · Oct 8, 2026

Vulhub apisix/CVE-2020-13945: Apache APISIX Default Admin Token RCE (CVE-2020-13945), run with Isoloom

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Apache APISIX - Insufficiently Protected Credentials http/cves/2020/CVE-2020-13945.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is al…