github - ghsa-6hrw-x7pr-4mp8

GHSA-6HRW-X7PR-4MP8

Vulnerability from github – Published: 2025-03-10 19:28 – Updated: 2025-03-14 19:56

Summary

LF Edge eKuiper allows Stored XSS in Rules Functionality

Details

Summary

Stored Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users' browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.

Details

A user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Rule id parameter. Then, after any user with access to this service (e.g. admin) will try make any modifications with the rule (update, run, stop, delete), a payload will act in victim's browser.

The issue appears as the notification to user is made in an insafe way:

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809

https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824

Such writing to 'http.ResponseWriter' bypasses HTML escaping that prevents cross-site scripting vulnerabilities.

Because of the some (meybe protection) mechanisms a real exploitation is possible only with limited special characters, but this is enough to construct a strong payload

PoC

Create a rule with id:

<iframe src="javascript:alert`1337`">

Creating a malicious Rule

Just after Rule Submition the Payload shoots:

Running Payload

Then, when another user (e.g. admin) will try to do something with this rule (e.g. start), the payload shoots in his context:

Exploiting the admin

Impact

Stored Cross-site Scripting (XSS) vulnerability

Reported by Alexey Kosmachev, Lead Pentester from Bi.Zone

Severity ?

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lf-edge/ekuiper/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lf-edge/ekuiper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.14.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-52812"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-10T19:28:38Z",
    "nvd_published_at": "2025-03-10T18:15:29Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nStored Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users\u0027 browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.\n\n### Details\n\nA user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Rule `id` parameter. Then, after any user with access to this service (e.g. admin) will try make any modifications with the rule (update, run, stop, delete), a payload will act in victim\u0027s browser.\n\nThe issue appears as the notification to user is made in an insafe way:\n\nhttps://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681\n\nhttps://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716\n\nhttps://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735\n\nhttps://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794\n\nhttps://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809\n\nhttps://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824\n\nSuch writing to \u0027http.ResponseWriter\u0027  bypasses HTML escaping that prevents cross-site scripting vulnerabilities.\n\nBecause of the some (meybe protection) mechanisms a real exploitation is possible only with limited special characters, but this is enough to construct a strong payload\n\n### PoC\n1. Create a rule with id:\n```\n\u003ciframe src=\"javascript:alert`1337`\"\u003e\n```\n![Creating a malicious Rule](https://github.com/user-attachments/assets/32d4f632-1f3c-471a-857b-7c4ce41030c6)\n\n2. Just after Rule Submition the Payload shoots:\n\n![Running Payload](https://github.com/user-attachments/assets/81021d04-e9a4-4e7f-8644-5240dcd2324c)\n\n3. Then, when another user (e.g. `admin`) will try to do something with this rule (e.g. start), the payload shoots in his context:\n\n![Exploiting the admin](https://github.com/user-attachments/assets/9adf9a33-966e-415a-a613-99a9b6cd4f10)\n\n### Impact\n\nStored Cross-site Scripting (XSS) vulnerability\n\nReported by Alexey Kosmachev, Lead Pentester from Bi.Zone",
  "id": "GHSA-6hrw-x7pr-4mp8",
  "modified": "2025-03-14T19:56:46Z",
  "published": "2025-03-10T19:28:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-6hrw-x7pr-4mp8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52812"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lf-edge/ekuiper"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lf-edge/ekuiper/releases/tag/v2.0.8"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3508"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LF Edge eKuiper allows Stored XSS in Rules Functionality"
}

CVE-2024-52812 (GCVE-0-2024-52812)

Vulnerability from cvelistv5 – Published: 2025-03-10 17:52 – Updated: 2025-03-11 20:13

Summary

LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule `id` parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/lf-edge/ekuiper/security/advis…	x_refsource_CONFIRM
	https://github.com/lf-edge/ekuiper/blob/dbce32d5a…	x_refsource_MISC
	https://github.com/lf-edge/ekuiper/blob/dbce32d5a…	x_refsource_MISC
	https://github.com/lf-edge/ekuiper/blob/dbce32d5a…	x_refsource_MISC
	https://github.com/lf-edge/ekuiper/blob/dbce32d5a…	x_refsource_MISC
	https://github.com/lf-edge/ekuiper/blob/dbce32d5a…	x_refsource_MISC
	https://github.com/lf-edge/ekuiper/blob/dbce32d5a…	x_refsource_MISC
	https://github.com/lf-edge/ekuiper/releases/tag/v2.0.8	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	lf-edge	ekuiper	Affected: < 2.0.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-52812",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-11T20:12:43.168456Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-11T20:13:01.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ekuiper",
          "vendor": "lf-edge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule `id` parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim\u0027s browser. Version 2.0.8 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-10T17:52:13.106Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-6hrw-x7pr-4mp8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/lf-edge/ekuiper/security/advisories/GHSA-6hrw-x7pr-4mp8"
        },
        {
          "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681"
        },
        {
          "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716"
        },
        {
          "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735"
        },
        {
          "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794"
        },
        {
          "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809"
        },
        {
          "name": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824"
        },
        {
          "name": "https://github.com/lf-edge/ekuiper/releases/tag/v2.0.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/lf-edge/ekuiper/releases/tag/v2.0.8"
        }
      ],
      "source": {
        "advisory": "GHSA-6hrw-x7pr-4mp8",
        "discovery": "UNKNOWN"
      },
      "title": "LF Edge eKuiper has Stored XSS in Rules Functionality"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-52812",
    "datePublished": "2025-03-10T17:52:13.106Z",
    "dateReserved": "2024-11-15T17:11:13.443Z",
    "dateUpdated": "2025-03-11T20:13:01.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-6HRW-X7PR-4MP8

Summary

Details

PoC

Impact

CVE-2024-52812 (GCVE-0-2024-52812)

Tags

Sightings

Nomenclature