CVE-2021-43557

Summary

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like //internal/ can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.

Affected Software

VendorProductVersion RangeStatus
Apache Software FoundationApache APISIX1.5 < Apache APISIX 1.5*affected

Weaknesses

  • Use Nginx's $request_uri variable without verification

Workarounds

  1. Upgrade to APISIX 2.10.2, or apply this commit which provides a normalized $request_uri: https://github.com/apache/apisix/commit/9fc38330e82ce46e2aaabceef7d61708c91782db
  2. Carefully review custom code, find & fix the usage of $request_uri without verification.

ADP Enrichment

CVE Program Container

Additional References

References