CVE-2021-43557
Path traversal in request_uri variable
- State
- Published
- Severity
- Not scored
- Published
- Nov 22, 2021
- Updated
- Aug 4, 2024
- Reserved
- Nov 9, 2021
Description
The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache APISIXApache Software Foundation |
|
References
- https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h
- [oss-security] 20211122 CVE-2021-43557: Apache APISIX: Path traversal in request_uri variablemailing-list
- [oss-security] 20211122 Re: CVE-2021-43557: Apache APISIX: Path traversal in request_uri variablemailing-list
- [oss-security] 20211123 Re: CVE-2021-43557: Apache APISIX: Path traversal in request_uri variablemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.