.. / CVE-2020-13945

• Access Control
• Nuclei
• Web

Exploit for Apache APISIX - Insufficiently Protected Credentials (CVE-2020-13945)

Description:

Apache APISIX 1.2, 1.3, 1.4, and 1.5 is susceptible to insufficiently protected credentials. An attacker can enable the Admin API and delete the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data.

Nuclei Template

View the template here CVE-2020-13945.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-13945.yaml

References: