CVE-2021-43557 Path traversal in request_uri variable

2021-11-2208:25:09

apache

www.cve.org

cve-2021-43557

path traversal

request_uri

apache apisix

uri-block plugin

verification

block list

customization

EPSS

0.003

Percentile

68.7%

JSON

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains “^/internal/”, a URI like //internal/ can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer’s custom plugin.

CNA Affected

[
  {
    "product": "Apache APISIX",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "Apache APISIX 1.5*",
        "status": "affected",
        "version": "1.5",
        "versionType": "custom"
      }
    ]
  }
]