GitHub Advisoryadvisory · Maven

GHSA-6768-mcjc-8223 Command injection leading to Remote Code Execution in Apache Storm

CRITICAL Published 2021-10-27 Modified 2022-10-19 Official page ↗
Aliases
CVE-2021-38294
Ecosystem
Maven
Packages
org.apache.storm:storm
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74, CWE-78
Reviewed
2021-10-26

Affected packages

• Maven org.apache.storm:storm: >= 2.2.0, < 2.2.1 → fixed in 2.2.1 • Maven org.apache.storm:storm: >= 2.0.0, < 2.1.1 → fixed in 2.1.1 • Maven org.apache.storm:storm: >= 1.0.0, < 1.2.4 → fixed in 1.2.4

Description

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Related

Alias · CVE (1)

  • CVE-2021-38294 A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x… vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References