LF Edge eKuiper has Stored XSS in Rules Functionality
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule `id` parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| LF-Edge, Zededa | ekuiper | before 2.0.8 | 2.0.8 | Patch available | CNA |
| — | github.com/lf-edge/ekuiper/v2 (Go) | before 2.0.8 | 2.0.8 | Patch available | GHSA-6hrw-x7pr-4mp8 |
| — | github.com/lf-edge/ekuiper (Go) | up to 1.14.7 | — | No fix listed | GHSA-6hrw-x7pr-4mp8 |
- ekuiper VendorLF-Edge, Zededa Affected before 2.0.8 Fixed in 2.0.8 Patch available CNA
- github.com/lf-edge/ekuiper/v2 (Go) Vendor— Affected before 2.0.8 Fixed in 2.0.8 Patch available GHSA-6hrw-x7pr-4mp8
- github.com/lf-edge/ekuiper (Go) Vendor— Affected up to 1.14.7 Fixed in — No fix listed GHSA-6hrw-x7pr-4mp8
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lfedge:ekuiper:*:*:*:*:*:*:*:* | — | — | LF-Edge, Zededa |
- cpe:2.3:a:lfedge:ekuiper:*:*:*:*:*:*:*:* Versions — — ·LF-Edge, Zededa
Remediation
- Fix · CNA ekuiper (lf-edge) Fixed in 2.0.8
- Fix · GHSA-6hrw-x7pr-4mp8 github.com/lf-edge/ekuiper/v2 (Go) Fixed in 2.0.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-52812
- 2026-10-03 Alias added: GHSA-6hrw-x7pr-4mp8
References
Other 10
- https://github.com/lf-edge/ekuiper/security/advisories/GHSA-6hrw-x7pr-4mp8
- https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681
- https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716
- https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735
- https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794
- https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809
- https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824
- https://github.com/lf-edge/ekuiper/releases/tag/v2.0.8
- https://github.com/lf-edge/ekuiper
- https://pkg.go.dev/vuln/GO-2025-3508
More LF-Edge, Zededa vulnerabilities
- TI-2025-34188 eKuiper API endpoints handling SQL queries with user-controlled table names. CVSS 4.0HIGH 8.9
- TI-2024-29055 LF Edge eKuiper has a SQL Injection in sqlKvStore CVSS 3.1HIGH 8.8
- TI-2024-34965 Stored XSS in Configuration Key Functionality CVSS 3.1MEDIUM 6.3
- TI-2023-23360 Freely Allocate Buffer on The Stack With Data From Socket CVSS 3.1CRITICAL 9.9
- TI-2023-23364 Rootfs Not Protected CVSS 3.1HIGH 8.8
- TI-2023-23363 Insufficiently protected credentials in LF-Edge, Zededa EVE OS CVSS 3.1HIGH 8.8
Sources
- CVE-2024-52812 · CVE Program
- CVE-2024-52812 · NVD
- FIRST EPSS
- GHSA-6hrw-x7pr-4mp8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences