Vulnerability · Published Oct 25, 2021 · Assigned by apache
CVE-2021-38294Shell Command Injection Vulnerability in Nimbus Thrift Server
Critical 9.8
In plain English
A critical-severity injection in Apache Storm from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 83.8% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)83.8%top 0.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Metasploit
Official description
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.storm:storm | 2.2.1 | GHSA-6768-mcjc-8223 |
| Maven | org.apache.storm:storm | 2.1.1 | GHSA-6768-mcjc-8223 |
| Maven | org.apache.storm:storm | 1.2.4 | GHSA-6768-mcjc-8223 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Storm | v1.0.0 – before Apache Storm* |
| Apache Software Foundation | Apache Storm | Apache Storm – before v1.2.4 |
Weakness: CWE-74
References
- https://lists.apache.org/thread.html/r5fe881f6ca883908b7a0f005d35115af49f43beea7a8b0915e377859%40%3Cuser.storm.apache.org%3E x_refsource_MISC
- https://seclists.org/oss-sec/2021/q4/44 x_refsource_MISC
- http://packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html x_refsource_MISC