falco-cve-2022-24112.yaml

- required_engine_version: 17

- macro: read_socket_recvfrom
  condition: evt.type=recvfrom and (fd.typechar='4' or fd.typechar='6')

- macro: apisix_using_default_api_key
  condition: ((evt.arg.data contains '"X-API-KEY":' and evt.arg.data contains '"edd1c9f034335f136f87ad84b625c8f1"') or evt.arg.data contains 'api_key=edd1c9f034335f136f87ad84b625c8f1')

- macro: apisix_json_params_rce
  condition: (evt.arg.data contains '/batch-requests' and 
              evt.arg.data contains '"pipeline"' and 
              evt.arg.data contains '"path"' and 
              evt.arg.data contains '"method"' and 
              evt.arg.data contains '"PUT"' and 
              evt.arg.data contains '"body"' and 
              evt.arg.data contains 'filter_func')

- rule: Apache APISIX Authentication Bypass CVE-2022-24112
  desc: Possible Apache APISIX Authentication Bypass using default API key detected CVE-2022-24112.
  condition: >
    evt.dir=< and 
    read_socket_recvfrom and 
    proc.name=openresty and
    apisix_using_default_api_key
  output: "CVE-2022-24112 (Apache APISIX) Possible Authentication Bypass using default API key detected (user.name=%user.name user.loginuid=%user.loginuid proc.exeline=%proc.exeline proc.name=%proc.name container.id=%container.id evt.args=%evt.args)"
  priority: ALERT
  tags: [host, container, exploit, CVE_2022_24112, atlassian_confluence, Mitre_Initial_Access, T1190]


- rule: Apache APISIX Authentication Bypass and Remote Code Execution CVE-2022-24112
  desc: Possible Apache APISIX Authentication Bypass and remote code execution using default API key detected CVE-2022-24112.
  condition: >
    evt.dir=< and 
    read_socket_recvfrom and 
    proc.name=openresty and
    apisix_using_default_api_key and
    apisix_json_params_rce
  output: "CVE-2022-24112 (Apache APISIX) Possible Authentication Bypass and remote code execution using default API key detected (user.name=%user.name user.loginuid=%user.loginuid proc.exeline=%proc.exeline proc.name=%proc.name container.id=%container.id evt.args=%evt.args)"
  priority: CRITICAL
  tags: [host, container, exploit, CVE_2022_24112, atlassian_confluence, Mitre_Initial_Access, T1190]