CVE-2022-25757

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-25757

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25757.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-25757

Aliases

BIT-apisix-2022-25757

Published

2022-03-28T07:00:16Z

Modified

2026-07-15T01:49:00.324947768Z

Summary

Apache APISIX: the body_schema check in request-validation plugin can be bypassed

Details

In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the bodyschema validation in the request-validation plugin. For example, {"string_payload":"bad","string_payload":"good"} can be used to hide the "bad" input. Systems satisfy three conditions below are affected by this attack: 1. use bodyschema validation in the request-validation plugin 2. upstream application uses a special JSON library that chooses the first occurred value, like jsoniter or gojay 3. upstream application does not validate the input anymore. The fix in APISIX is to re-encode the validated JSON input back into the request body at the side of APISIX. Improper Input Validation vulnerability in COMPONENT of Apache APISIX allows an attacker to IMPACT. This issue affects Apache APISIX Apache APISIX version 2.12.1 and prior versions.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "Apache APISIX"
                },
                {
                    "last_affected": "2.12.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "2.13.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cwe_ids": [
        "CWE-20"
    ],
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25757.json"
}

References

Affected packages

Git / github.com/apache/apisix

Affected ranges

Type

GIT

Repo

https://github.com/apache/apisix

Events

Introduced

Fixed

f43a20e587e3494cbc924278ad317bf98cfa3201

Database specific

{
    "cpe": "cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.13.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

0.*

0.9-RC1

v0.*

v0.2

v0.3

v0.3-1

v0.4

v0.4.1

v0.5

v0.7

v0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25757.json"