Listen to this Post
How the CVE Works
The vulnerability exists in the `getLast` API of eKuiper due to improper SQL query construction. User-supplied input (table parameter) is directly interpolated into an SQL query using `fmt.Sprintf` without sanitization. The query:
query := fmt.Sprintf("SELECT FROM %s ORDER BY rowid DESC LIMIT 1", table)
allows attackers to inject malicious SQL commands. For example, sending `sensors; DROP TABLE users; –` as the `table` parameter results in execution of arbitrary SQL, leading to data manipulation or deletion. The flaw is exposed via API endpoints handling time-series data queries.
DailyCVE Form
Platform: eKuiper
Version: <1.10.0
Vulnerability: SQL Injection
Severity: Critical
Date: 2023-03-15
Prediction: Patch by 2023-04-10
What Undercode Say
curl -X POST http://localhost:9081/sql-query -H "Content-Type: application/json" -d '{"table":"sensors; DROP TABLE users; --","operation":"getLast"}'
sqlite3 etc/kuiper/data/kuiper.db ".tables"
How Exploit
Crafted API request with malicious SQL in `table` parameter.
Protection from this CVE
- Use parameterized queries.
- Input validation/sanitization.
- Update to patched version.
Impact
- Data theft/corruption.
- Full database compromise.
- Unauthenticated RCE (context-dependent).
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
