{"vulnerability": "CVE-2021-43557", "sightings": [{"uuid": "1fdb620b-b9e2-4c19-8858-a4508b523e78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/cKure/8218", "content": "\u25a0\u25a0\u25a0\u25a1\u25a1 CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable.\n\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable/", "creation_timestamp": "2021-11-25T22:41:13.000000Z"}, {"uuid": "f150fee4-ef79-44b7-bb88-d4802e45b1e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/483", "content": "#CVE-2021-43557 Apache APISIX Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n\n#poc for CVE-2021-43557\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2021-11-24T08:57:32.000000Z"}, {"uuid": "7d970082-66b8-47fa-ae62-3e44ddf517a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "Telegram/7lOg35W8EDhondHOu_l4LlZeIPa0pj8gOC8hBeOw9Gj5jg", "content": "", "creation_timestamp": "2021-11-23T22:38:07.000000Z"}, {"uuid": "15b5e50e-2481-484d-8b98-f53900835a42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/1212", "content": "#exploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc\n\n@BlueRedTeam", "creation_timestamp": "2021-11-24T08:06:07.000000Z"}, {"uuid": "6e957f41-164d-47a8-a085-c698ebba02ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4822", "content": "#exploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2021-11-24T11:03:01.000000Z"}, {"uuid": "a0c0d090-4877-4b52-9611-0b2386c92d7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1851", "content": "CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable https://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable/", "creation_timestamp": "2026-08-03T04:12:55.976655Z"}, {"uuid": "ee55b3bb-201a-4876-af8a-2a01b7534ff9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "seen", "source": "Telegram/IBDLQiEWHO72tUJ2Ylqd3zBHJI3jkAPrj_4aeIoADYB6Hgg", "content": "", "creation_timestamp": "2026-08-27T12:00:10.890802Z"}, {"uuid": "ac507c93-610e-425b-a96f-4a531b05f523", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "Telegram/IBDLQiEWHO72tUJ2Ylqd3zBHJI3jkAPrj_4aeIoADYB6Hgg", "content": "", "creation_timestamp": "2026-08-29T00:00:15.686652Z"}, {"uuid": "d0708630-d362-4d02-97d3-82cac95849d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "seen", "source": "https://t.me/reverseame/1851", "content": "CVE-2021-43557: Apache APISIX: Path traversal in request_uri variable https://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable/", "creation_timestamp": "2026-07-29T12:02:51.207204Z"}, {"uuid": "628fd569-9252-4e77-b208-4ba8c3ea5d74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "seen", "source": "https://t.me/cissp/4879", "content": "Offensive_security\nSecurity Testing and Enumeration of WebSockets\nhttps://github.com/PalindromeLabs/STEWS#installation--usage\n\nexploit\nCVE-2021-41379:\nWindows installer LPE 0day\nhttps://github.com/klinix5/InstallerFileTakeOver\n\nThreat_Research\n1. Unauthenticated RCE against CommVault Command Center\nhttps://srcincite.io/blog/2021/11/22/unlocking-the-vault.html\n]-> PoC: https://srcincite.io/pocs/cve-2021-%7B34993,34996%7D.py.txt\n2. A review of Microsoft Azure Sphere vulnerabilities\nhttps://blog.talosintelligence.com/2021/11/a-review-of-azure-sphere.html?m=1\n3. Exploiting the Qualcomm NPU (neural processing unit) kernel driver (CVE-2021-1940, CVE-2021-1968, CVE-2021-1969)\nhttps://securitylab.github.com/research/qualcomm_npu\n\n_security\nPicky PPID Spoofing\nhttps://captmeelo.com/redteam/maldev/2021/11/22/picky-ppid-spoofing.html\n\nexploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2026-09-01T17:00:34.827876Z"}, {"uuid": "74924fac-6be2-47a1-85d5-72d013bee84a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4879", "content": "Offensive_security\nSecurity Testing and Enumeration of WebSockets\nhttps://github.com/PalindromeLabs/STEWS#installation--usage\n\nexploit\nCVE-2021-41379:\nWindows installer LPE 0day\nhttps://github.com/klinix5/InstallerFileTakeOver\n\nThreat_Research\n1. Unauthenticated RCE against CommVault Command Center\nhttps://srcincite.io/blog/2021/11/22/unlocking-the-vault.html\n]-> PoC: https://srcincite.io/pocs/cve-2021-%7B34993,34996%7D.py.txt\n2. A review of Microsoft Azure Sphere vulnerabilities\nhttps://blog.talosintelligence.com/2021/11/a-review-of-azure-sphere.html?m=1\n3. Exploiting the Qualcomm NPU (neural processing unit) kernel driver (CVE-2021-1940, CVE-2021-1968, CVE-2021-1969)\nhttps://securitylab.github.com/research/qualcomm_npu\n\n_security\nPicky PPID Spoofing\nhttps://captmeelo.com/redteam/maldev/2021/11/22/picky-ppid-spoofing.html\n\nexploit\nCVE-2021-43557:\nApache APISIX: Path traversal in request_uri variable\nhttps://xvnpw.github.io/posts/cve_2021_43557_apache_apisix_path_traversal_in_request_uri_variable\n]-> PoC:\nhttps://github.com/xvnpw/k8s-CVE-2021-43557-poc", "creation_timestamp": "2026-09-10T14:00:06.275858Z"}, {"uuid": "1fe74b30-4a5c-4e7e-a07b-44be5cc7ad57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "seen", "source": "https://t.me/timcore_hacking/2786", "content": "#hackthebox\n#htb\n#hacking\n\nHackTheBox - Pikatwoo\n\n00:00 - Introduction\n01:00 - Start of nmap\n03:15 - Identifying all the technologies used in the box\n10:45 - Looking at OpenStack Keystone Authentication and discovering CVE-2021-38155\n12:15 - Pulling up API DOCS to see how to login to Keystone, then testing lockout\n14:00 - Taking the Burpsuite Request, sending it to FFUF and using a trick to try each password multiple times\n25:30 - Attempting to access Swift as a vendor to bypass auth, using GoBuster and discovering an Android directory with Pokatmon app in it\n35:10 - Start of analyzing the Pokatmon App, examining DNS, setting up a MITM with Burpsuite and Socat\n40:15 - Using Frida to disable TLS Certificate Pinning on Flutter\n45:20 - Discovering the App Signs every request, grabbing the certificate out of the app, and signing our own request\n49:20 - Performing an SQL Injection, getting an email address then looking for vulnerabilities in Forgot Password on the main website\n58:48 - Discovering CVE-2021-43557 in APISIX, which gives us an idea to URLEncode Paths to bypass blacklists and gaining access to the /private/ directory which has a /forgot-password we can use to reset Roger's password\n1:04:45 - Logging into the docs, gaining access to the API and finding an LFI\n1:09:45 - Looking into CVE-2021-35368, which is a ModSecurity Bypass that allows us to abuse the LFI\n1:18:10 - Using NGINX's temporary files with our PHP LFI to gain code execution\n1:27:55 - Shell returned on Pokatdex-API, exporting Kubernetes secrets\n1:34:20 - Discovering an APISIX admin key and exploiting this service by creating a route that executes code\n1:59:20 - Shell returned on the APISIX box, discovering credentials we can SSH with\n2:11:10 - Explioting the CRI-O with Kubernetes to set a kernel param to execute a script when a core dump is created (CVE-2022-0811)\n\n\nhttps://www.youtube.com/watch?v=gRj9Uz8_EOY", "creation_timestamp": "2023-09-14T12:26:19.000000Z"}, {"uuid": "cd059960-cc2c-417e-a240-a2eef1324f9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-43557", "type": "published-proof-of-concept", "source": "https://t.me/timcore_hacking/2786", "content": "#hackthebox\n#htb\n#hacking\n\nHackTheBox - Pikatwoo\n\n00:00 - Introduction\n01:00 - Start of nmap\n03:15 - Identifying all the technologies used in the box\n10:45 - Looking at OpenStack Keystone Authentication and discovering CVE-2021-38155\n12:15 - Pulling up API DOCS to see how to login to Keystone, then testing lockout\n14:00 - Taking the Burpsuite Request, sending it to FFUF and using a trick to try each password multiple times\n25:30 - Attempting to access Swift as a vendor to bypass auth, using GoBuster and discovering an Android directory with Pokatmon app in it\n35:10 - Start of analyzing the Pokatmon App, examining DNS, setting up a MITM with Burpsuite and Socat\n40:15 - Using Frida to disable TLS Certificate Pinning on Flutter\n45:20 - Discovering the App Signs every request, grabbing the certificate out of the app, and signing our own request\n49:20 - Performing an SQL Injection, getting an email address then looking for vulnerabilities in Forgot Password on the main website\n58:48 - Discovering CVE-2021-43557 in APISIX, which gives us an idea to URLEncode Paths to bypass blacklists and gaining access to the /private/ directory which has a /forgot-password we can use to reset Roger's password\n1:04:45 - Logging into the docs, gaining access to the API and finding an LFI\n1:09:45 - Looking into CVE-2021-35368, which is a ModSecurity Bypass that allows us to abuse the LFI\n1:18:10 - Using NGINX's temporary files with our PHP LFI to gain code execution\n1:27:55 - Shell returned on Pokatdex-API, exporting Kubernetes secrets\n1:34:20 - Discovering an APISIX admin key and exploiting this service by creating a route that executes code\n1:59:20 - Shell returned on the APISIX box, discovering credentials we can SSH with\n2:11:10 - Explioting the CRI-O with Kubernetes to set a kernel param to execute a script when a core dump is created (CVE-2022-0811)\n\n\nhttps://www.youtube.com/watch?v=gRj9Uz8_EOY", "creation_timestamp": "2023-09-14T12:26:19.000000Z"}]}