Re: CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable

[Marcin Niemiec <niemiec.marcin () gmail com>]

Hi,

Looks good to me.

It's really awesome that you verified this issue and provided fix so
quickly!

Best,
Marcin

pon., 22 lis 2021 o 07:30 Zexuan Luo <spacewander () apache org> napisał(a):

> Severity: moderate
>
> Description:
>
> The uri-block plugin in APISIX uses $request_uri without verification.
> The $request_uri is the full original request URI without
> normalization.
> This makes it possible to construct a URI to bypass the block list on
> some occasions. For instance, when the block list contains
> "^/internal/", a URI like `//internal/` can be used to bypass it.
>
> Some other plugins also have the same issue. And it may affect the
> developer's custom plugin.
>
> This issue is fixed in APISIX 2.10.2.
> Thanks to Marcin Niemiec for reporting the vulnerability.
>
> Mitigation:
>
> 1. Upgrade to APISIX 2.10.2
> 2. Carefully review custom code, find & fix the usage of $request_uri
> without verification.