CVE-2025-24979

Name of the Vulnerable Software and Affected Versions eKuiper versions prior to 2.4.0

Description A Server-side request forgery (SSRF) issue exists where the server does not validate destination IP addresses during external service registrations and HTTP invocations. An attacker with permissions to register external services or create rules can induce the server to make requests to unintended network locations, including internal services, loopback interfaces (localhost), or cloud metadata endpoints. This can be achieved by registering an external service pointing to an internal address and triggering queries using service functions. This allows for probing internal networks, leaking sensitive information such as credentials, or interacting with internal APIs accessible to the host.

Recommendations Upgrade to eKuiper version 2.4.0 or later. Restrict access to the eKuiper REST API (port 9081) and CLI using network firewalls, reverse proxies, and authentication. Implement egress network filtering via firewall or iptables rules to block outbound requests to private subnets, loopback addresses, and cloud metadata endpoints (169.254.169.254). Regularly audit registered external services using GET /services or bin/kuiper show services to verify target hosts.