Apache APISIX batch-requests Plugin IP Restriction Bypass and Remote Code Execution (CVE-2022-24112)

1. Vulnerability Overview & Root Cause

This vulnerability exists within the batch-requests plugin of Apache APISIX. The plugin is designed to accept multiple HTTP requests in a single batch and contains a mechanism to override the client IP with its real remote IP for security validation. However, due to a logical flaw in the code, this validation check can be bypassed. This allows remote attackers to spoof their source IP address, making requests appear as if they originated from trusted sources such as the local loopback interface (127.0.0.1).

2. Exploitation Mechanics & Attack Scenario

An attacker sends a crafted JSON payload to the batch-requests endpoint (/apisix/batch-requests). By exploiting the IP verification bypass, the attacker routes requests internally to the Admin API. If the deployment uses the default Admin Key (e.g., edd1c9f034335f136f87ad84b625c8f1) or if the Admin API port is exposed alongside the data panel, the attacker can successfully authenticate. Once authenticated, the attacker registers a malicious Route containing arbitrary Lua code (via parameters like filter_func), leading to Remote Code Execution (RCE) under the privileges of the APISIX process.

3. Infrastructure & Business Impact

As a CISA KEV-listed vulnerability, this flaw is actively exploited in the wild. Successful exploitation grants the attacker full control over the API Gateway instance. Since the API Gateway acts as the entry point for enterprise microservices, compromise of this layer can lead to traffic interception, credential theft from backend services, and lateral movement deeper into the internal cloud infrastructure.