stormGHSA-6768-mcjc-8223

Command injection leading to Remote Code Execution in Apache Storm

CVE-2021-38294 · Published Oct 27, 2021 · updated Nov 8, 2023

Critical9.8

Fix: upgrade to 1.2.4 or later (3 fixed versions below)

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Affected versions

Package	Affected	Fixed in
org.apache.storm:storm Maven	>= 2.2.0, < 2.2.1	2.2.1
	>= 2.0.0, < 2.1.1	2.1.1
	>= 1.0.0, < 1.2.4	1.2.4

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-74, CWE-78
Also known as: CVE-2021-38294

More storm advisories

All storm

High 7.5May 17, 2022

Apache Storm log viewer path traversal vulnerabilityCVE-2014-0115no fix yet Critical 9.8May 14, 2022

Apache Storm remote code execution vulnerabilityCVE-2015-3188fixed in 0.10.0-beta1 Critical 9.8Oct 27, 2021

Deserialization of Untrusted Data leading to Remote Code Execution in Apache StormCVE-2021-40865fixed in 1.2.4 +2