The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.
Metrics
Affected Vendors & Products
Fixes
Solution
No solution given by the vendor.
Workaround
1. Upgrade to APISIX 2.10.2, or apply this commit which provides a normalized $request_uri: https://github.com/apache/apisix/commit/9fc38330e82ce46e2aaabceef7d61708c91782db 2. Carefully review custom code, find & fix the usage of $request_uri without verification.
References
History
No history.

Status: PUBLISHED
Assigner: apache
Published:
Updated: 2024-08-04T04:03:07.927Z
Reserved: 2021-11-09T00:00:00
Link: CVE-2021-43557

No data.

Status : Modified
Published: 2021-11-22T09:15:07.627
Modified: 2024-11-21T06:29:25.887
Link: CVE-2021-43557

No data.

No data.