CVE-2025-24978: XSS
Summary A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces.
Details Prior to v2.4.0, external service registration endpoints did not strictly enforce alphanumeric character restrictions on service names. An operator or attacker with API access could register a service using a crafted name containing HTML elements (such as <iframe src="...">). If an administrative web UI rendered the unescaped service name, arbitrary script execution could occur in the context of the user's browser session.
PoC 1. Create an external service JSON definition with a filename containing an XSS payload, e.g. <iframe src="javascript:alert1337">.json inside a ZIP archive. 2. In external service creation, upload the ZIP and provide the matching service name: <iframe src="javascript:alert1337">. 3. Upon service registration, the unescaped name executes when rendered in the UI context.
Impact Self-XSS / Stored XSS leading to potential session token leakage or unauthorized actions in the context of the affected user's browser session.
Remediation & Patches - Upgrade to eKuiper >= 2.4.0: Strict alphanumeric identifier validation (validate.ValidateID) is now enforced on all external service creation and update endpoints, rejecting invalid characters.
Workarounds - Protect eKuiper management endpoints (POST /services) with authentication and network-level firewalls.
Credits - Reported by Alexey Kosmachev, Bi.Zone (@TheMostKnown)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/lf-edge/ekuiper/v2to a version that resolves this vulnerability.Fixed in 2.4.0 - Upgrade
Upgrade
eKuiperto a version that resolves this vulnerability.Fixed in 2.4.0 - Compensating control
Protect eKuiper management endpoints (POST /services) with authentication and network-level firewalls.
Event History
Frequently Asked Questions
Who needs to be able to exploit this issue?
An attacker needs authenticated API access or operator-level access sufficient to create or register an external service. Exploitation also depends on an administrative web interface rendering the crafted service name without escaping it.
Which versions are affected?
The issue affects versions prior to v2.4.0. Version v2.4.0 is identified as the release after strict alphanumeric restrictions on external service names were enforced.
What conditions make the impact more likely?
A malicious external service name must be registered, such as through the ZIP-based external service creation workflow, and then viewed in an administrative UI that renders the name unescaped. The resulting browser-context script execution could enable session-token theft or unauthorized actions.
How can administrators check for possible exploitation?
Review registered external service names and uploaded external-service ZIP definitions for names containing HTML or script-like characters, including tags such as iframe. Pay particular attention to service names that would not meet an alphanumeric-only naming policy.