Skipper存在通过github.com/zalando/skipper中lua过滤器执行任意代码的漏洞

The RCE vulnerability in Skipper arises from the lack of proper sanitization and validation of Lua filter input. An attacker who can control or modify the filter configuration can inject arbitrary Lua code. This code will be executed with the privileges of the Skipper process, granting the attacker the ability to read, write, and execute files on the system. Successful exploitation could lead to data exfiltration, denial of service, or even complete takeover of the server hosting Skipper. The impact is particularly severe in environments where Skipper is used to proxy sensitive traffic or manage critical APIs.

Organizations using Skipper as an API gateway, particularly those relying on Lua filters for request modification or routing, are at risk. Environments with limited security controls or those running older, unpatched versions of Skipper are especially vulnerable. Shared hosting environments where multiple users share the same Skipper instance could also be affected.

• go / process monitoring: Use ps aux | grep skipper to identify running Skipper processes. Monitor their resource usage for unusual spikes.

ps aux | grep skipper

• go / file integrity: Check the integrity of Skipper's binary and configuration files using checksums. Compare against known good values.

mdfsum /usr/local/bin/skipper /etc/skipper/skipper.yaml

• generic web / request inspection: Examine incoming requests to Skipper for unusual Lua filter parameters or payloads. Look for patterns indicative of code injection attempts. • generic web / log analysis: Review Skipper's access and error logs for any errors or warnings related to Lua filter execution. Search for keywords like 'lua', 'error', and 'filter'.

1. 2026-02-03Disclosure

   disclosure

1. 已保留2026-01-15
2. 发布日期2026-02-03
3. 修改日期2026-03-03
4. EPSS 更新日期2026-03-23

The primary mitigation is to upgrade Skipper to version 0.23.0 or later, which includes the necessary fixes to prevent arbitrary code execution. If upgrading immediately is not possible, consider temporarily disabling Lua filters entirely. This can be achieved by removing or commenting out any filter configurations that utilize Lua. As a further precaution, implement strict input validation and sanitization for all filter configurations. Monitor Skipper logs for any suspicious activity related to Lua filter execution. Consider using a Web Application Firewall (WAF) to filter out potentially malicious Lua code.