CVE-2019-0202: Exposure of Sensitive Information in Apache Storm Logviewer
Summary
CVE-2019-0202: Exposure of Sensitive Information in Apache Storm Logviewer. Affects org.apache.storm:storm-core versions >= 0.9.1-incubating, < 1.2.3. Fixed in 1.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Storm is a distributed real-time computation system designed to process large amounts of data. It includes a Logviewer daemon that provides HTTP-accessible endpoints to read and search log files on hosts running Storm. This vulnerability affects Apache Storm versions 0.9.1-incubating to 1.2.2. The Logviewer daemon allows unauthorized access to files on the host's file system that were not intended to be accessible via these endpoints.
Vulnerability Detail
The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints that can be used to read and search log files. However, due to a flaw in versions 0.9.1-incubating to 1.2.2, it is possible for an attacker to access files on the host's file system that were not meant to be accessible. This can lead to the exposure of sensitive information that may include credentials, configuration files, or other sensitive data. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
1.2.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable or restrict access to the Logviewer daemon. This can be done by modifying the configuration to prevent external access to the Logviewer endpoints. Here is an example of how to modify the Storm configuration file (storm.yaml) to disable the Logviewer daemon:
storm.logviewer.enabled: false
After making this change, restart the Storm service to apply the configuration.
Conclusion
The exposure of sensitive information in Apache Storm Logviewer can lead to serious security risks and potential data breaches. It is crucial to upgrade to Apache Storm version 1.2.3 or later to fix this vulnerability. If immediate upgrade is not possible, disabling or restricting access to the Logviewer daemon can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.storm:storm-core →
FAQ
Apache Storm is a distributed real-time computation system designed to process large amounts of data. It provides a scalable and fault-tolerant platform for processing streaming data.
The Logviewer daemon in Apache Storm provides HTTP-accessible endpoints to read and search log files on hosts running Storm. It allows users to easily access and analyze log data for troubleshooting and monitoring purposes.
This vulnerability allows unauthorized access to files on the host's file system through the Logviewer daemon. It can lead to the exposure of sensitive information, such as credentials or configuration files, which can be used by attackers to compromise the system or gain unauthorized access.
The CVSS score of this vulnerability is 7.5, indicating a high severity. It is important to address this vulnerability promptly to prevent potential data breaches or unauthorized access.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Apache Storm version is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including CVE-2019-0202.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.storm:storm-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
