Skip to content
OpenAdvisories
Critical · 9.8 Known exploited Scanner template Public exploit CVE-2022-24112 EUVD-2022-29024GHSA-2vc7-6w39-6rh2

apisix/batch-requests plugin allows overwriting the X-REAL-IP header

Published Feb 11, 2022 · Updated Oct 21, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache APISIX

Description

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache APISIX Apache APISIX 2.12 – < 2.12.1, Apache APISIX 2.10 – < 2.10.4, 1.3 – < Apache APISIX 1* 2.12.1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 1

GitHub 9 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References