CVE-2018-1331: Apache Storm Core Arbitrary Code Execution
Summary
CVE-2018-1331: Code execution in org.apache.storm:storm-core. Affects org.apache.storm:storm-core across 2 version ranges.
< 1.1.3
>= 1.2.0, < 1.2.2
Fixed in 1.1.3 or 1.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Storm is a distributed real-time computation system designed to process large volumes of data. The storm-core package is a fundamental component of Apache Storm, providing core functionality and APIs for building distributed applications. Unfortunately, versions 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1 of storm-core are vulnerable to an arbitrary code execution attack.
Vulnerability Detail
The vulnerability allows an attacker with access to a secure storm cluster to execute arbitrary code as a different user. This means that an attacker could potentially gain unauthorized access to sensitive data, modify or delete data, or disrupt the normal operation of the storm cluster. The vulnerability exists due to a security flaw in the affected versions of storm-core.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.1.31.1.3 -
>= 1.2.0, < 1.2.21.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to version 1.2.2 is not immediately feasible, a possible workaround is to restrict access to the storm cluster to trusted users only. By limiting access to the cluster, the risk of exploitation can be reduced. However, this workaround does not address the underlying vulnerability and should be considered temporary.
Conclusion
The Apache Storm Core Arbitrary Code Execution vulnerability (CVE-2018-1331) is a high severity issue that affects versions 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1 of the storm-core package. It allows an attacker with access to a secure storm cluster to execute arbitrary code as a different user. To mitigate this vulnerability, it is recommended to upgrade to version 1.2.2 of the storm-core package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.storm:storm-core →
FAQ
Apache Storm is a distributed real-time computation system designed to process large volumes of data.
storm-core is a package that provides core functionality and APIs for building distributed applications using Apache Storm.
Versions 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1 of storm-core are affected.
The vulnerability allows an attacker to execute arbitrary code as a different user, potentially leading to unauthorized access, data manipulation, or disruption of the storm cluster.
To fix this vulnerability, it is recommended to upgrade to version 1.2.2 of the storm-core package.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.storm:storm-core.
