module
Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution
| Disclosed |
|---|
| 2021-10-25 |
Disclosed
2021-10-25
Description
This module exploits an unauthenticated command injection vulnerability within the Nimbus service component of Apache Storm.
The getTopologyHistory RPC method method takes a single argument which is the name of a user which is
concatenated into a string that is executed by bash. In order for the vulnerability to be exploitable, there
must have been at least one topology submitted to the server. The topology may be active or inactive, but at
least one must be present. Successful exploitation results in remote code execution as the user running Apache Storm.
This vulnerability was patched in versions 2.1.1, 2.2.1 and 1.2.4. This exploit was tested on version 2.2.0
which is affected.
The getTopologyHistory RPC method method takes a single argument which is the name of a user which is
concatenated into a string that is executed by bash. In order for the vulnerability to be exploitable, there
must have been at least one topology submitted to the server. The topology may be active or inactive, but at
least one must be present. Successful exploitation results in remote code execution as the user running Apache Storm.
This vulnerability was patched in versions 2.1.1, 2.2.1 and 1.2.4. This exploit was tested on version 2.2.0
which is affected.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.