CVE-2014-0115: Apache Storm log viewer path traversal vulnerability
Summary
CVE-2014-0115: Apache Storm log viewer path traversal vulnerability. Affects org.apache.storm:storm versions < 0.9.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Storm is an open-source distributed real-time computation system used for processing and analyzing large streams of data. It provides a scalable and fault-tolerant platform for processing data in real-time. The log viewer in Apache Storm allows users to view log files generated by the system. However, a directory traversal vulnerability in the log viewer of Apache Storm 0.9.0.1 exposes a security flaw that can be exploited by remote attackers to read arbitrary files on the server.
Vulnerability Detail
The vulnerability arises due to insufficient input validation in the file parameter of the log viewer. By including a .. (dot dot) sequence in the file parameter, an attacker can traverse directories and access files outside the intended scope. This allows them to read sensitive information, such as configuration files or credentials, that should not be accessible to unauthorized users. The impact of this vulnerability can be severe, as it compromises the confidentiality of sensitive data and may lead to further exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the log viewer or disable it entirely if it is not essential for their operations. This can be done by modifying the server configuration to block access to the log viewer URL or by removing the log viewer component from the deployment. However, this workaround should only be considered as a temporary measure until the system can be updated to a patched version.
Conclusion
The Apache Storm log viewer path traversal vulnerability (CVE-2014-0115) exposes a security flaw that allows remote attackers to read arbitrary files on the server. It is crucial to upgrade to a patched version of Apache Storm to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.storm:storm →
FAQ
Apache Storm is an open-source distributed real-time computation system used for processing and analyzing large streams of data.
The log viewer in Apache Storm allows users to view log files generated by the system.
A directory traversal vulnerability allows an attacker to access files outside the intended scope by manipulating input parameters to traverse directories.
The vulnerability allows remote attackers to read arbitrary files on the server, potentially exposing sensitive information and compromising the confidentiality of data.
To fix this vulnerability, it is recommended to upgrade to a patched version of Apache Storm.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.storm:storm.
