CyberRota Analysis
This is a high severity vulnerability with a CVSS score of 7.5. It affects Apache. Its EPSS score suggests a 14.6% probability of exploitation in the next 30 days.
CVE
CVE-2021-43557
Severity
HIGH
CVSS
7.5
EPSS
14.59%
Apache
Original NVD Description
The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.
Related CVEs
Other vulnerabilities affecting the same vendor(s)