CVE-2021-43557

Katalog CVE

CVSS 7.5 · High EPSS 12,9%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada apache apisix. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.

Rincian

Terbit di NVD

22 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

12,9% peluang dieksploitasi; lebih tinggi dari 96,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h exploit · mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2021/11/22/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/11/22/2 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/11/23/1 exploit · mailing list · advisory pihak ketiga