Skip to content

Latest commit

 

History

History
62 lines (53 loc) · 6.6 KB

attack-surface.md

File metadata and controls

62 lines (53 loc) · 6.6 KB

Attack Surface Analysis for apache/incubator-apisix

Attack Surface: Unprotected Admin API

  • Description: The APISIX Admin API provides full control over the gateway's configuration. Exposure without proper authentication or authorization allows attackers to reconfigure the entire system.
    • How APISIX Contributes: APISIX provides the Admin API as its primary control interface. Its default configuration (if not changed) can be easily exploited.
    • Example: An attacker discovers the Admin API exposed on port 9180 with default credentials (admin/admin). They use the API to redirect all traffic to a malicious server.
    • Impact: Complete compromise of the API gateway; data theft, service disruption, potential compromise of backend services.
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Change Default Credentials: Immediately change the default Admin API credentials to strong, unique passwords.
      • Network Segmentation: Restrict access to the Admin API to a trusted management network only. Use firewall rules (iptables, cloud security groups) to prevent public access.
      • API Key Authentication: Enable and enforce API key authentication for all Admin API requests.
      • Disable Unused Endpoints: If specific Admin API endpoints are not required, disable them to reduce the attack surface.
      • TLS Encryption: Ensure the Admin API is accessed only over HTTPS (TLS) to prevent credential sniffing.
      • Regular Audits: Periodically audit access logs and configurations to detect unauthorized access attempts.

Attack Surface: Insecure etcd Configuration

  • Description: APISIX uses etcd as its configuration store. If etcd is insecurely configured (e.g., exposed to the internet, weak authentication), attackers can directly modify APISIX's configuration.
    • How APISIX Contributes: APISIX relies on etcd for its operation. The security of APISIX is directly tied to the security of the etcd cluster.
    • Example: An attacker finds that the etcd instance used by APISIX is accessible without authentication. They directly modify etcd to add a malicious route that intercepts user credentials.
    • Impact: Complete control over APISIX configuration, similar to compromising the Admin API; data theft, service disruption.
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Secure etcd: Follow etcd's official security guidelines. This includes:
        • Strong Authentication: Enable authentication and use strong, unique credentials for etcd clients.
        • TLS Encryption: Enable TLS encryption for both client-to-server and peer-to-peer communication within the etcd cluster.
        • Network Segmentation: Isolate the etcd cluster on a private network, accessible only to APISIX nodes and authorized management systems.
      • Dedicated etcd Cluster: Use a dedicated etcd cluster specifically for APISIX, separate from other applications.
      • Regular Audits: Regularly audit etcd's configuration and security settings.

Attack Surface: Vulnerable Plugins (Third-Party or Custom)

  • Description: Vulnerabilities in third-party or custom-developed APISIX plugins can be exploited to compromise the gateway.
    • How APISIX Contributes: APISIX's plugin architecture allows for extensibility, but also introduces the risk of vulnerabilities in those plugins.
    • Example: A custom plugin designed to perform authentication has a SQL injection vulnerability. An attacker exploits this vulnerability to gain unauthorized access.
    • Impact: Varies depending on the plugin's functionality. Can range from denial of service to remote code execution (RCE) within the APISIX worker process.
    • Risk Severity: High to Critical (depending on the plugin)
    • Mitigation Strategies:
      • Plugin Vetting: Thoroughly vet any third-party plugins before deployment. Review the source code (if available), check for known vulnerabilities, and assess the plugin's reputation.
      • Regular Updates: Keep all plugins updated to the latest versions to address security patches.
      • Secure Coding Practices (Custom Plugins): Follow secure coding practices when developing custom plugins. This includes:
        • Input Validation: Validate and sanitize all inputs to the plugin.
        • Output Encoding: Properly encode outputs to prevent cross-site scripting (XSS) vulnerabilities.
        • Secure Handling of Secrets: Avoid hardcoding secrets; use secure methods for storing and retrieving credentials.
        • Least Privilege: Grant the plugin only the minimum necessary permissions.
      • Sandboxing (Future): Explore potential sandboxing mechanisms for plugins to limit their impact in case of compromise (this is an area of ongoing research).

Attack Surface: Route Manipulation

  • Description: Attackers who gain even limited access to modify route configurations can redirect traffic, intercept data, or cause denial of service.
    • How APISIX Contributes: APISIX's core function is routing. Misconfigured or maliciously altered routes are a direct threat.
    • Example: An attacker gains access to a less-privileged account that can modify routes. They create a route that redirects a portion of traffic to a phishing site.
    • Impact: Data leakage, man-in-the-middle attacks, denial of service.
    • Risk Severity: High
    • Mitigation Strategies:
      • Strict Access Control: Implement strict access control to route configuration, limiting access to authorized users and systems. Use the principle of least privilege.
      • Input Validation (Route Configuration): Ensure that the route configuration process rigorously validates all inputs to prevent injection attacks or the creation of malicious routes. This includes validating regular expressions, upstream addresses, and other route parameters.
      • Change Management: Implement a formal change management process for route modifications, including review and approval steps.
      • Monitoring and Alerting: Monitor for suspicious changes to route configurations and set up alerts for unauthorized modifications. Log all route changes with timestamps and user information.