PRP: Request Apache APISIX default secret key causes RCE vulnerability

[hh-hunter]

Hello,
I would like to start the implementation for a plugin that detects APISIX default secret key causes RCE vulnerability,
The vulnerability should be relatively new and it is a serious problem due to the default configuration. It has a built-in default API KEY. If the user does not actively modify it (very few people will modify it), Lua scripts can be executed directly through the API interface, which will lead to RCE vulnerabilities. Some articles are as follows.

• https://security.tencent.com/index.php/blog/msg/183
• https://apisix.apache.org/docs/apisix/architecture-design/script
• https://apisix.apache.org/docs/apisix/admin-api/#route
• https://mp.weixin.qq.com/s/Me2bjRtmBQv--Aj9I_2cwg

Please let me know if this is in scope to start with its development.

[tooryx]

Hi @hh-hunter,

You can work on this.

~tooryx