LF Edge eKuiper Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in LF Edge eKuiper versions through 1.14.4. This issue allows users with the kuiperUser role to inject malicious scripts into the Connection Configuration key 'Name' parameter. When an admin user attempts to delete the key, the injected script is executed in the admin's browser, potentially leading to session hijacking or unauthorized access to sensitive information.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of other users' browsers.

Reproduction

To reproduce this vulnerability, log in as a user with the kuiperUser role. Navigate to the 'Configuration > Connection' page and add a new configuration key. Intercept the request and inject a cross-site scripting payload into the 'confKey' parameter. Once the key is saved, authorize as an admin user and delete the connection. The injected payload will execute in the admin's browser.

Remediation

Users are advised to update to LF Edge eKuiper version 2.1.0 or later.