CVE-2021-43557
📋 TL;DR
CVE-2021-43557 is a URI normalization bypass vulnerability in Apache APISIX's uri-block plugin that allows attackers to bypass block lists by using specially crafted URIs with double slashes or other normalization issues. This affects Apache APISIX deployments using the uri-block plugin or other plugins with similar URI handling logic. Attackers can potentially access restricted endpoints that should be blocked.
💻 Affected Systems
- Apache APISIX
📦 What is this software?
Apisix by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of security controls allowing unauthorized access to internal/admin endpoints, potentially leading to data exposure, privilege escalation, or further attacks.
Likely Case
Partial bypass of URI-based access controls allowing access to some restricted endpoints that should be blocked by the uri-block plugin.
If Mitigated
Limited impact with proper network segmentation and additional authentication layers preventing full exploitation.
🎯 Exploit Status
Exploitation requires knowledge of block list patterns and ability to send HTTP requests. Examples provided in advisory show simple bypass techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.10.2
Vendor Advisory: https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h
Restart Required: Yes
Instructions:
1. Upgrade Apache APISIX to version 2.10.2 or later. 2. Restart APISIX service. 3. Verify the fix by testing URI normalization.
🔧 Temporary Workarounds
Custom URI Normalization
allImplement custom URI normalization in plugins to normalize $request_uri before processing
Modify plugin code to normalize URIs: local normalized_uri = ngx.re.sub(uri, "//+", "/")
WAF Rule
allDeploy WAF rules to detect and block double-slash URI patterns
🧯 If You Can't Patch
- Disable uri-block plugin and use alternative access control methods
- Implement network-level controls to restrict access to potentially vulnerable endpoints
🔍 How to Verify
Check if Vulnerable:
Test if URIs with double slashes (like //internal/) bypass block list rules that should block /internal/Check Version:
apisix versionVerify Fix Applied:
After patching, test that normalized URIs are properly handled and block lists work correctly📡 Detection & Monitoring
Log Indicators:
- HTTP requests with double slashes in URI
- Access to blocked endpoints via alternative URI patterns
Network Indicators:
- Unusual URI patterns in HTTP traffic
- Requests to endpoints that should be blocked
SIEM Query:
http.uri contains "//" AND (http.uri contains "internal" OR http.uri contains restricted_patterns)🔗 References
- http://www.openwall.com/lists/oss-security/2021/11/22/1
- http://www.openwall.com/lists/oss-security/2021/11/22/2
- http://www.openwall.com/lists/oss-security/2021/11/23/1
- https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h
- http://www.openwall.com/lists/oss-security/2021/11/22/1
- http://www.openwall.com/lists/oss-security/2021/11/22/2
- http://www.openwall.com/lists/oss-security/2021/11/23/1
- https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h
