PT-2021-5490 · Apache · Apache Storm

Alvaro Muñoz + 1 · Published 2021-10-25 · Updated 2021-11-28 · CVE-2021-40865

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Storm versions 2.2.x prior to 2.2.1 Apache Storm versions 2.1.x prior to 2.1.1 Apache Storm versions 1.x prior to 1.2.4

Description An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server, allowing pre-auth Remote Code Execution (RCE). This vulnerability can be exploited by a remote attacker to execute arbitrary code in the target system.

Recommendations For Apache Storm versions 2.2.x, upgrade to version 2.2.1 or 2.3.0. For Apache Storm versions 2.1.x, upgrade to version 2.1.1. For Apache Storm versions 1.x, upgrade to version 1.2.4.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2021-06339

CVE-2021-40865

GHSA-W729-7633-2FW5

OESA-2021-1415

Affected Products

Apache Storm

References · 13

• 🔥 https://github.com/hktalent/CVE-2021-40865 · Exploit
• https://osv.dev/vulnerability/GHSA-w729-7633-2fw5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40865 · Vendor Advisory
• https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40865 · Security Note
• https://osv.dev/vulnerability/OESA-2021-1415 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06339 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021112001 · Note
• https://t.me/cvenotify/22325 · Telegram Post
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1415 · Note
• https://seclists.org/oss-sec/2021/q4/45 · Note
• https://lists.apache.org/thread/wt9f7lsz6xhyxotf0g099w3xbs9f1b1x · Note
• https://t.me/cybersecuritytechnologies/4850 · Telegram Post