CVE-2021-43557

moderate-risk
Published 2021-11-22

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.

Do I need to act?

!
58.3% chance of exploitation in next 30 days
EPSS score — higher than 42% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Apache

References (8)

Mailing List http://www.openwall.com/lists/oss-security/2021/11/22/1
Mailing List http://www.openwall.com/lists/oss-security/2021/11/22/2
Exploit http://www.openwall.com/lists/oss-security/2021/11/23/1
Exploit https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h
Mailing List http://www.openwall.com/lists/oss-security/2021/11/22/1
Mailing List http://www.openwall.com/lists/oss-security/2021/11/22/2
Exploit http://www.openwall.com/lists/oss-security/2021/11/23/1
Exploit https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h
49
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 18/34 · Moderate
Exposure 5/34 · Minimal