{"items":[{"id":"NVI-00015362","kind":"vulnerability","title":"LF Edge eKuiper: SSRF in External Service","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pqqc-8v73-9gg2","CVE-2025-24979"],"plain_summary":"GitHub lists this reviewed advisory for github.com/lf-edge/ekuiper/v2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5fc5e06b6a8c39af094d78b6ef96d628"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-09T17:56:33.000Z","value":"5.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5fc5e06b6a8c39af094d78b6ef96d628"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5fc5e06b6a8c39af094d78b6ef96d628","url":"https://github.com/advisories/GHSA-pqqc-8v73-9gg2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pqqc-8v73-9gg2","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T22:54:12.705Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5fc5e06b6a8c39af094d78b6ef96d628"],"technology":"github.com/lf-edge/ekuiper/v2","known_exclusions":[],"conditions_summary":"### Summary\nServer-side request forgery (SSRF) vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services, loopback interfaces (localhost), or cloud metadata endpoints.\n\n### Details\nPrior to v2.4.0, eKuiper external service registrations and HTTP invocations did not validate destination IP addresses. An attacker with access to the eKuiper management API could register an external service pointing to an internal address (such as `http://127.0.0.1:9081` or other internal network services) and trigger queries using service functions (e.g. `SELECT tsschemaless(...) FROM demo`). This allows probing internal networks, leaking sensitive information (such as internal endpoints/credentials), or interacting with internal APIs accessible to the eKuiper host.\n\n### PoC\n1. Create an external service with an address pointing to an internal network / localhost:\n\n```json\n{\n  \"interfaces\": {\n    \"tsschemaless\": {\n      \"address\": \"http://127.0.0.1:9081\",\n      \"protocol\": \"rest\",\n      \"options\": {\n        \"insecureSkipVerify\": true,\n        \"header","public_affected_ranges":["< 2.4.0"]}],"null_published_at":"2026-11-03T10:03:31.357Z","source_updated_at":"2026-09-09T17:56:33.000Z","source_disclosed_at":"2026-09-09T17:56:32.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T22:54:12.705Z"}],"next_cursor":null,"snapshot_revision":"42594"}