Remote code execution in Apache Storm

1) Remote code execution

EUVDB-ID: #VU13796

Risk: High

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1331

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The vulnerability exists due to unspecified flaw. A remote attacker can on a secure storm cluster can execute arbitrary code with the privileges of a different user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

The vulnerability is fixed in the versions 1.1.3, 1.2.2.

Vulnerable software versions

Apache Storm: 0.10.0 - 1.2.1

External links

http://storm.apache.org/2018/06/04/storm113-released.html
http://storm.apache.org/2018/06/04/storm122-released.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.