Re: CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable

[Zhiyuan Ju <juzhiyuan () apache org>]

Hi,

Thanks to Marcin, and Apache APISIX's Website just published his blog about
this CVE[1].

 Welcome to read this post :)

[1] https://apisix.apache.org/blog/2021/11/23/cve-2021-43557-research-report

Best Regards!
@ Zhiyuan Ju <https://github.com/juzhiyuan>


Zexuan Luo <spacewander () apache org> 于2021年11月22日周一 下午2:30写道：

> Severity: moderate
>
> Description:
>
> The uri-block plugin in APISIX uses $request_uri without verification.
> The $request_uri is the full original request URI without
> normalization.
> This makes it possible to construct a URI to bypass the block list on
> some occasions. For instance, when the block list contains
> "^/internal/", a URI like `//internal/` can be used to bypass it.
>
> Some other plugins also have the same issue. And it may affect the
> developer's custom plugin.
>
> This issue is fixed in APISIX 2.10.2.
> Thanks to Marcin Niemiec for reporting the vulnerability.
>
> Mitigation:
>
> 1. Upgrade to APISIX 2.10.2
> 2. Carefully review custom code, find & fix the usage of $request_uri
> without verification.