CVE-2018-11779: Deserialization of Untrusted Data in Apache Storm
Summary
CVE-2018-11779: Deserialization of Untrusted Data in Apache Storm. Affects org.apache.storm:storm-kafka versions >= 1.1.0, < 1.2.3. Fixed in 1.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Storm is a distributed real-time computation system that allows users to process large streams of data in real-time. It provides a scalable and fault-tolerant platform for processing and analyzing data streams. The storm-kafka and storm-kafka-client modules are used in Apache Storm to integrate with Apache Kafka, a distributed streaming platform. These modules allow Storm to consume data from Kafka topics and process it in real-time. However, a vulnerability in these modules allows an attacker to deserialize user-provided bytes into a Java class, potentially leading to remote code execution.
Vulnerability Detail
The vulnerability exists in Apache Storm versions 1.1.0 to 1.2.2 when using the storm-kafka or storm-kafka-client modules. An attacker can exploit this vulnerability by providing malicious serialized data to the Storm UI daemon. When the deserialization process occurs, the attacker's code can be executed, leading to potential remote code execution. This can result in unauthorized access, data breaches, and other malicious activities.
How To Fix
Minimum fixed version
1.2.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to Apache Storm version 1.2.3 or later.
Conclusion
The deserialization vulnerability in Apache Storm can lead to remote code execution and other malicious activities. It is crucial to upgrade to the fixed version of Apache Storm and follow secure coding practices to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.storm:storm-kafka →
FAQ
Apache Storm is a distributed real-time computation system used for processing large streams of data in real-time. It provides a scalable and fault-tolerant platform for processing and analyzing data streams.
The vulnerability affects Apache Storm versions 1.1.0 to 1.2.2.
This vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, and other malicious activities.
To fix this vulnerability, it is recommended to upgrade to Apache Storm version 1.2.3 or later and update the dependencies to use the fixed version of the storm-kafka or storm-kafka-client modules.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to Apache Storm version 1.2.3 or later.
