Shreemaan-Abhishek

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

**Nome do Software Vulnerável e Versões Afetadas** Apache APISIX versões 3.17.0 through 3.18.0 **Description** Existe uma vulnerabilidade de Cross-Site Request Forgery (CSRF) nos plugins feishu-auth e dingtalk-auth. Um invasor pode enganar um usuário para clicar em um link manipulado, fazendo com que a sessão do navegador do usuário em uma rota protegida seja estabelecida sob a identidade do invasor. Consequentemente, qualquer ação realizada pelo usuário durante essa sessão, como envios de formulários, uploads ou vinculações de conta, será associada à conta do invasor. **Recommendations** Atualizar para a versão 3.19.0.

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache APISIX: from 1.3.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue affects Apache APISIX: from 3.12.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.