CVE-2020-15170
📋 TL;DR
CVE-2020-15170 is an access control vulnerability in Apollo AdminService that allows unauthenticated attackers to directly access administrative APIs. This enables attackers to view and modify application configurations if the service is exposed to untrusted networks. Only deployments exposing Apollo AdminService to the internet or untrusted internal networks are affected.
💻 Affected Systems
- Apollo AdminService
📦 What is this software?
Apollo by Ctrip
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full control over application configurations, potentially modifying critical settings, injecting malicious code, or disrupting service availability across all applications managed by Apollo.
Likely Case
Unauthorized access to sensitive configuration data, potential configuration tampering leading to application misbehavior or data exposure.
If Mitigated
No impact if service is properly isolated in trusted network segments with appropriate network controls.
🎯 Exploit Status
Exploitation requires network access to the AdminService port. No authentication or special tools needed - attackers can directly call administrative APIs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.1
Vendor Advisory: https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh
Restart Required: Yes
Instructions:
1. Upgrade Apollo AdminService to version 1.7.1 or later. 2. Restart the AdminService. 3. Verify the service is running the patched version.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to Apollo AdminService to trusted internal networks only
iptables -A INPUT -p tcp --dport 8090 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 8090 -j DROP
Reverse Proxy with Authentication
allPlace Apollo AdminService behind a reverse proxy with authentication (e.g., nginx with basic auth)
location / { auth_basic "Restricted"; auth_basic_user_file /etc/nginx/.htpasswd; proxy_pass http://localhost:8090; }
🧯 If You Can't Patch
- Immediately isolate Apollo AdminService to trusted internal network segments only
- Implement network access controls (firewall rules) to restrict access to authorized IP addresses
🔍 How to Verify
Check if Vulnerable:
Check if Apollo AdminService version is below 1.7.1 AND is accessible from untrusted networksCheck Version:
curl -s http://localhost:8090/version | grep versionVerify Fix Applied:
Verify version is 1.7.1 or higher and test that administrative APIs require authentication when accessed📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to AdminService APIs
- Configuration changes from unexpected IP addresses
Network Indicators:
- External IP addresses accessing AdminService port 8090
- Unusual API call patterns to configuration endpoints
SIEM Query:
source="apollo-admin.log" AND ("POST /" OR "PUT /") AND NOT src_ip IN [TRUSTED_NETWORKS]🔗 References
- https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf
- https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh
- https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf
- https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh
