GHSA-6hrw-x7pr-4mp8

Source

https://github.com/advisories/GHSA-6hrw-x7pr-4mp8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-6hrw-x7pr-4mp8/GHSA-6hrw-x7pr-4mp8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6hrw-x7pr-4mp8

Aliases

CVE-2024-52812
GO-2025-3508

Published

2025-03-10T19:28:38Z

Modified

2025-03-14T19:56:46Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

LF Edge eKuiper allows Stored XSS in Rules Functionality

Details

Summary

Stored Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users' browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.

Details

A user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Rule id parameter. Then, after any user with access to this service (e.g. admin) will try make any modifications with the rule (update, run, stop, delete), a payload will act in victim's browser.

The issue appears as the notification to user is made in an insafe way:

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824

Such writing to 'http.ResponseWriter' bypasses HTML escaping that prevents cross-site scripting vulnerabilities.

Because of the some (meybe protection) mechanisms a real exploitation is possible only with limited special characters, but this is enough to construct a strong payload

PoC

Create a rule with id:
```
<iframe src="javascript:alert`1337`">
```
Just after Rule Submition the Payload shoots:

Running Payload

Then, when another user (e.g. admin) will try to do something with this rule (e.g. start), the payload shoots in his context:

Exploiting the admin

Impact

Stored Cross-site Scripting (XSS) vulnerability

Reported by Alexey Kosmachev, Lead Pentester from Bi.Zone

Database specific

{
    "nvd_published_at": "2025-03-10T18:15:29Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-10T19:28:38Z"
}

References

Affected packages

Go / github.com/lf-edge/ekuiper/v2

Package

Name: github.com/lf-edge/ekuiper/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/lf-edge/ekuiper/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.8

Go / github.com/lf-edge/ekuiper

Package

Name: github.com/lf-edge/ekuiper; View open source insights on deps.dev
Purl: pkg:golang/github.com/lf-edge/ekuiper

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.14.7