CVE-2024-52812
LF Edge eKuiper has Stored XSS in Rules Functionality
LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule id parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
LF Edge eKuiper has Stored XSS in Rules Functionality
LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule id parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.
- Record
CVE-2024-52812- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-54233
LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule id parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.
- Record
EUVD-2024-54233- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6hrw-x7pr-4mp8
LF Edge eKuiper allows Stored XSS in Rules Functionality
Summary
Stored Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users' browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.
Details
A user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Rule id parameter. Then, after any user with access to this service (e.g. admin) will try make any modifications with the rule (update, run, stop, delete), a payload will act in victim's browser.
The issue appears as the notification to user is made in an insafe way:
Such writing to 'http.ResponseWriter' bypasses HTML escaping that prevents cross-site scripting vulnerabilities.
Because of the some (meybe protection) mechanisms a real exploitation is possible only with limited special characters, but this is enough to construct a strong payload
PoC
- Create a rule with id:
<iframe src="javascript:alert`1337`">
- Just after Rule Submition the Payload shoots:
- Then, when another user (e.g.
admin) will try to do something with this rule (e.g. start), the payload shoots in his context:
Impact
Stored Cross-site Scripting (XSS) vulnerability
Reported by Alexey Kosmachev, Lead Pentester from Bi.Zone
- Record
GHSA-6hrw-x7pr-4mp8- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule id parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.
- Record
CVE-2024-52812- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
LF Edge eKuiper has Stored XSS in Rules Functionality
LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule id parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim's browser. Version 2.0.8 fixes the issue.
- Record
CVE-2024-52812- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-6hrw-x7pr-4mp8
LF Edge eKuiper allows Stored XSS in Rules Functionality
Summary
Stored Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users' browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.
Details
A user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Rule id parameter. Then, after any user with access to this service (e.g. admin) will try make any modifications with the rule (update, run, stop, delete), a payload will act in victim's browser.
The issue appears as the notification to user is made in an insafe way:
Such writing to 'http.ResponseWriter' bypasses HTML escaping that prevents cross-site scripting vulnerabilities.
Because of the some (meybe protection) mechanisms a real exploitation is possible only with limited special characters, but this is enough to construct a strong payload
PoC
- Create a rule with id:
<iframe src="javascript:alert`1337`">
- Just after Rule Submition the Payload shoots:
- Then, when another user (e.g.
admin) will try to do something with this rule (e.g. start), the payload shoots in his context:
Impact
Stored Cross-site Scripting (XSS) vulnerability
Reported by Alexey Kosmachev, Lead Pentester from Bi.Zone
- Record
GHSA-6hrw-x7pr-4mp8- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGO-2025-3508 No score
LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper
LF Edge eKuiper allows Stored XSS in Rules Functionality in github.com/lf-edge/ekuiper
- Record
GO-2025-3508- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14893-1 No score
govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250313T170021-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14893-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/lf-edge/ekuiper/v2Go |
before 2.0.8 | 2.0.8 |
github.com/lf-edge/ekuiperGo |
through 1.14.7 | None known |
github.com/lf-edge/ekuiperGo |
All versions | None known |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 0.0.20250313T170021-1.1 | 0.0.20250313T170021-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-52812 is a medium vulnerability (CVSS 5.4) in Lf-edge Ekuiper, published March 10, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in github.com/lf-edge/ekuiper/v2 2.0.8.
References
github.com/lf-edge/ekuiper/security/advisories/GHSA-6hrw-x7pr-4mp8
nvd.nist.gov/vuln/detail/CVE-2024-52812
pkg.go.dev/vuln/GO-2025-3508
Show 9 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/IISU33DXNWHOYGRCT77IPABZTMARV5T6
suse.com/security/cve/CVE-2024-1725