Description
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache APISIX Dashboard | 2.7 and 2.7.1, 2.8, 2.9, 2.10 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 11 repositories · most starred shown
-
wuppp/cve-2021-45232-exp ★ 78 · Dec 29, 2021
-
GYLQ/CVE-2021-45232-RCE ★ 33 · Jan 5, 2022
CVE-2021-45232-RCE-多线程批量漏洞检测
-
YutuSec/Apisix_Crack ★ 8 · May 9, 2022
Apisix系列漏洞：未授权漏洞（CVE-2021-45232）、默认秘钥（CVE-2020-13945）批量探测。
-
yggcwhat/CVE-2021-45232 ★ 1 · Jan 8, 2022
一键批量检测poc
-
fany0r/CVE-2021-45232-RCE ★ 1 · Jan 5, 2022
CVE-2021-45232-RCE
-
LTiDi2000/CVE-2021-45232 ★ 1 · Dec 28, 2021
-
dskho/CVE-2021-45232 ★ 0 · Dec 30, 2021
CVE-2021-45232 POC
-
jxpsx/CVE-2021-45232-RCE ★ 0 · Dec 29, 2021
CVE-2021-45232 RCE
-
badboycxcc/CVE-2021-45232-POC ★ 0 · Dec 28, 2021
-
Osyanina/westone-CVE-2021-45232-scanner ★ 0 · Dec 28, 2021
A vulnerability scanner that detects CVE-2021-45232 vulnerabilities.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache APISIX Dashboard <2.10.1 - API Unauthorized Access http/cves/2021/CVE-2021-45232.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.