Finding 0day in Apache APISIX During CTF (CVE-2022-24112)

This code audit of the API6 challenge from Real World CTF investigates Apache APISIX and discovers how a default configuration can be escalated to remote code execution. The exploit uses the batch-requests plugin for server-side request forgery (SSRF), bypasses an X-Real-IP restriction, and became CVE-2022-24112. LEARN ON HEXTREE (ad) Learn hacking on Hextree: https://www.hextree.io/ Watch this video and more on Hextree: https://app.hextree.io/courses/yt-0da... Join the Hextree Discord:   / discord   RESOURCES CVE-2022-24112: https://seclists.org/oss-sec/2022/q1/133 GitLab Real World CTF write-up: https://liveoverflow.com/gitlab-11-4-... Challenge files: https://github.com/chaitin/Real-World... CHAPTERS 00:00 - Intro 01:09 - Initial Application Overview 02:15 - Discussing Approaches 03:56 - Reading Documentation 04:57 - Initial Attack Idea 06:15 - Identifying Attack Surface 08:46 - Discovering Batch Requests 09:18 - Bypassing X-Real-IP Header 10:15 - Testing the Exploit 11:11 - Reporting the Issue 12:16 - Outro SUPPORT Per video:   / liveoverflow   Per month:    / @liveoverflow   Buy my handwriting font (ad): https://shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel:    / liveunderflow   Twitch:   / liveoverflow   Twitter:   / liveoverflow   Instagram:   / liveoverflow   TikTok:   / liveoverflow_   LiveOverflow blog: https://liveoverflow.com/ Hextree blog (ad): https://www.hextree.io/blog #WebSecurity #CTF #LiveOverflow (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.