PT-2024-30563 · Lf Edge · Lf Edge Ekuiper

Leonnewton · Published 2024-08-20 · Updated 2024-08-26 · CVE-2024-43406

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LF Edge eKuiper versions prior to 1.14.2

Description A SQL Injection vulnerability exists in the sqlKvStore of LF Edge eKuiper, allowing the execution of malicious SQL queries via the Get method. This issue affects various handlers, including explainRuleHandler, sourceManageHandler, asyncTaskCancelHandler, and pluginHandler. The rule id can be used to exploit SQL queries, and the delete function is also vulnerable.

Recommendations For versions prior to 1.14.2, update to version 1.14.2 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable sqlKvStore module to minimize the risk of exploitation. Avoid using the rule id in the affected API endpoints until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-43406

GHSA-R5PH-4JXM-6J9P

GO-2024-3078

PYSEC-2024-72

Affected Products

Lf Edge Ekuiper

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43406.json · Exploit
• 🔥 https://github.com/lf-edge/ekuiper/security/advisories/GHSA-r5ph-4jxm-6j9p · Exploit
• https://github.com/lf-edge/ekuiper/commit/1a9c745649438feaac357d282959687012b65503 · Patch
• https://osv.dev/vulnerability/CVE-2024-43406 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43406 · Security Note
• https://osv.dev/vulnerability/GO-2024-3078 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r5ph-4jxm-6j9p · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-72 · Vendor Advisory
• https://github.com/lf-edge/ekuiper · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ekuiper/PYSEC-2024-72.yaml · Note
• https://twitter.com/CVEnew/status/1825918397395185992 · Twitter Post
• https://twitter.com/CveFindCom/status/1827005692290486539 · Twitter Post
• https://t.me/cvedetector/3646 · Telegram Post