You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hello,
I would like to start the implementation for a plugin that detects APISIX default secret key causes RCE vulnerability,
The vulnerability should be relatively new and it is a serious problem due to the default configuration. It has a built-in default API KEY. If the user does not actively modify it (very few people will modify it), Lua scripts can be executed directly through the API interface, which will lead to RCE vulnerabilities. Some articles are as follows.
tooryx
added
Contributor main
The main issue a contributor is working on (top of the contribution queue).
and removed
Contributor queue
When a contributor has already one issue/PR in review, we put the following ones on hold with this.
labels
Jul 31, 2024
Hello,
I would like to start the implementation for a plugin that detects APISIX default secret key causes RCE vulnerability,
The vulnerability should be relatively new and it is a serious problem due to the default configuration. It has a built-in default API KEY. If the user does not actively modify it (very few people will modify it), Lua scripts can be executed directly through the API interface, which will lead to RCE vulnerabilities. Some articles are as follows.
Please let me know if this is in scope to start with its development.
The text was updated successfully, but these errors were encountered: