CVE-2022-25757: Apache APISIX Auth Bypass Vulnerability

CVE-2022-25757 Overview

CVE-2022-25757 is an Improper Input Validation vulnerability in Apache APISIX before version 2.13.0. When decoding JSON with duplicate keys, the lua-cjson library used by APISIX chooses the last occurred value as the result. This behavior discrepancy allows attackers to bypass the body_schema validation in the request-validation plugin by passing JSON payloads with duplicate keys, effectively hiding malicious input from validation checks while delivering it to upstream applications that process JSON differently.

Critical Impact

Attackers can bypass request validation controls to inject malicious payloads into upstream applications, potentially leading to unauthorized access, data manipulation, or complete system compromise depending on the upstream application's functionality.

Affected Products

• Apache APISIX version 2.12.1 and prior versions
• Systems using body_schema validation in the request-validation plugin
• Deployments where upstream applications use JSON libraries that choose the first occurred value (e.g., jsoniter, gojay)

Discovery Timeline

• 2022-03-28 - CVE-2022-25757 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-25757

Vulnerability Analysis

This vulnerability exploits a fundamental inconsistency in how different JSON parsing libraries handle duplicate keys within JSON objects. The JSON specification (RFC 8259) states that object member names "SHOULD be unique" but does not mandate uniqueness, leaving the behavior for duplicate keys implementation-dependent. Apache APISIX uses lua-cjson for JSON parsing, which selects the last occurrence of a duplicate key when constructing the parsed object.

When an attacker submits a JSON payload with duplicate keys, APISIX validates the payload using the last value (which passes validation), while upstream applications using different JSON libraries may process the first value instead. This creates a validation bypass where malicious content in the first occurrence escapes security checks but reaches the application for processing.

Root Cause

The root cause is the inconsistent handling of duplicate JSON keys between the APISIX gateway's lua-cjson library and upstream application JSON parsers. Since lua-cjson selects the last value for duplicate keys during validation, but certain upstream JSON libraries (such as jsoniter or gojay in Go applications) select the first value, the validated and processed values differ. This semantic mismatch creates a TOCTOU-like vulnerability where the time-of-check (validation) and time-of-use (processing) operate on different interpretations of the same payload.

Attack Vector

The attack requires network access to the APISIX gateway and exploits the validation bypass through crafted HTTP requests. An attacker constructs a JSON payload where the first occurrence of a key contains malicious data that would normally be rejected by validation, while the second (duplicate) occurrence contains benign data that passes validation.

For example, an attacker could submit a payload like {"string_payload":"bad","string_payload":"good"}. APISIX validates against "good" (last value) and permits the request, but an upstream application using jsoniter processes "bad" (first value). This allows the attacker to bypass input validation entirely for systems meeting three conditions: using body_schema validation, having upstream applications with first-value JSON parsers, and lacking secondary input validation at the application layer.

Detection Methods for CVE-2022-25757

Indicators of Compromise

• HTTP requests containing JSON bodies with duplicate keys in request logs
• Anomalous input processing in upstream applications that differs from expected validated values
• Application-level errors or unexpected behavior indicating receipt of malicious payloads that should have been blocked

Detection Strategies

• Implement deep packet inspection rules to detect JSON payloads containing duplicate object keys
• Deploy web application firewall (WAF) rules specifically targeting JSON key duplication patterns
• Enable verbose logging on APISIX to capture full request bodies for forensic analysis
• Monitor upstream application logs for input validation failures that contradict gateway validation success

Monitoring Recommendations

• Establish baseline metrics for request validation plugin activity and monitor for anomalies
• Configure alerting for upstream application errors that may indicate validation bypass exploitation
• Implement correlation between APISIX validation logs and upstream application input processing logs
• Deploy SentinelOne Singularity to monitor for post-exploitation activity resulting from validation bypass

How to Mitigate CVE-2022-25757

Immediate Actions Required

• Upgrade Apache APISIX to version 2.13.0 or later immediately
• Review all APISIX deployments using the request-validation plugin with body_schema validation
• Implement additional input validation at the upstream application layer as defense-in-depth
• Audit upstream applications to identify those using JSON libraries that prefer first-value semantics

Patch Information

The fix implemented in Apache APISIX 2.13.0 re-encodes the validated JSON input back into the request body after validation. This ensures that the normalized JSON (with duplicate keys resolved to the last value) is forwarded to upstream applications, eliminating the semantic mismatch between validation and processing. Organizations should upgrade to version 2.13.0 or later to remediate this vulnerability. For detailed information, refer to the Apache Thread Discussion and the Openwall OSS Security List Post.

Workarounds

• If immediate patching is not possible, implement upstream application-level input validation to reject duplicate JSON keys
• Deploy a reverse proxy or WAF in front of APISIX configured to normalize or reject JSON with duplicate keys
• Temporarily disable the request-validation plugin if upstream applications perform adequate validation
• Consider switching upstream applications to JSON libraries that use last-value semantics to match APISIX behavior

# Verify APISIX version and upgrade if necessary
apisix version
# If running version < 2.13.0, upgrade immediately
# For Docker deployments:
docker pull apache/apisix:2.13.0
# Restart APISIX after upgrade
apisix restart