.. / CVE-2021-45232

• Access Control
• Nuclei
• Web

Exploit for Apache APISIX Dashboard <2.10.1 - API Unauthorized Access (CVE-2021-45232)

Description:

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin.' While all APIs and authentication middleware are developed based on framework droplet, some API directly use the interface of framework gin` thus bypassing their authentication.

Nuclei Template

View the template here CVE-2021-45232.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-45232.yaml

References: