Skip to content
Fencer Vulns
high 7.5

CVE-2021-43557 in the critical feed json

Path traversal in request_uri variable

published 2021-11-22 4 y ago modified 2026-09-08 2 mo ago also BIT-apisix-2021-43557 , EUVD-2021-30486

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
13.0%
EPSS 13.0% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.

Patch / fix

  • bitnami apisix 2.10.2
  • apache apisix 2.10.2

Exploit prediction

13.04% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • lists.apache.org https://lists.apache.org/thread/18jyd458ptocr31rnkjs71w4h366mv7h referenced PoC, tagged "exploit" by a source, unverified
  • openwall.com http://www.openwall.com/lists/oss-security/2021/11/23/1 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
bitnami apisix
<2.10.2
2.10.2

Affected products

  • Apache Software Foundation Apache APISIX

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.