Listen to this Post
How the mentioned CVE works:
The CVE-2024-52419 vulnerabilities stem from eKuiper’s failure to properly sanitize user-supplied input before using it in filesystem operations. Attacker-controlled inputs, such as rule names, plugin names, and filenames within uploaded ZIP archives, are incorporated into file paths without validation for path traversal sequences like “../”. This allows an attacker to break out of the intended directory structure. For instance, by submitting a plugin name containing “../”, the application could be tricked into writing or reading files from arbitrary locations on the server filesystem. During archive extraction, malicious filenames within a ZIP file could cause contents to be written to parent directories, leading to arbitrary file creation or overwrite. This direct use of unsanitized input in path joins and file operations creates a critical path traversal flaw.
Platform: eKuiper
Version: < 1.14.0
Vulnerability: Path Traversal
Severity: Critical
date: 2024
Prediction: Patch available
What Undercode Say:
curl -X POST http://ekuiper:9081/streams --data '{"sql": "CREATE STREAM ../etc/passwd () WITH (DATASOURCE=\"topic\")"}'
zip exploit.zip ../../../bin/evil.sh
Malicious plugin name payload plugin_name = "../../../tmp/backdoor"
How Exploit:
Craft malicious rule names.
Upload ZIP with traversal filenames.
Use “../” in schema versions.
Protection from this CVE
Update to v1.14.0.
Implement input sanitization.
Restrict filesystem permissions.
Validate archive entries.
Impact:
Arbitrary file overwrite.
Sensitive file disclosure.
Denial of service.
Full system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
