Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue.
An attacker exploits a specific configuration of the forward-auth plugin in Apache APISIX to inject malicious HTTP headers into transmitted requests. The forward-auth plugin is responsible for delegating authorization to external services — manipulating headers at this stage may allow bypassing authentication mechanisms or substituting data passed to the backend. The vulnerability is classified as CWE-75 (improper neutralization of special characters in HTTP headers), indicating a lack of proper input data sanitization.
An attacker can compromise the confidentiality and integrity of processed requests by injecting arbitrary HTTP headers, which may lead to bypassing authorization mechanisms or manipulating data transmitted to protected backend services.
Apache APISIX should be updated to version 3.16.0, which contains a patch eliminating the described vulnerability. Detailed information is available in the official Apache project announcement at the address indicated in the references.
Apache APISIX versions from 2.12.0 to 3.15.0 inclusive, using the forward-auth plugin.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NApache Apisix
APPApache2.12.0 – 3.16.0 (excl.)
Related vulnerabilities
Apache APISIX – RCE przez obejście ograniczeń IP w batch-requests
Apache APISIX — pominięcie walidacji body_schema przez duplikaty kluczy JSON
Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway ...
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISI...
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache A...