Apache Storm maintainers patch two pre-auth RCE vulnerabilities

guest · Nov 10, 2021

Apache Storm maintainers patch two pre-auth RCE vulnerabilities
High-risk issues were discovered by GitHub’s in-house security team
November 10, 2021
https://portswigger.net/daily-swig/apache-storm-maintainers-patch-two-pre-auth-rce-vulnerabilities

Apache Storm, an open source real-time streaming data analytics platform, has patched two vulnerabilities that led to remote code execution (RCE).

Discovered and reported by GitHub Security Labs, the bugs included a command injection vulnerability and an unsafe deserialization bug.
Click to expand...

Command injection in Apache Storm Nimbus
The first of the two vulnerabilities was found in one of the functions of Nimbus, the principal component of Storm, which runs on top of a Thrift server.

“This vulnerability was not exploitable when reached through the REST API since the username that holds the payload cannot be controlled by an attacker,” Alvaro Munoz, researcher at GitHub Security Labs, told The Daily Swig.
“However, I found out that I could directly call the Thrift service and provide any username.”
Click to expand...

Unsafe deserialization on supervisor server
The second bug was found in Storm’s supervisor service, which runs on top of a Netty server. In his research, Munoz discovered that the server’s inbound pipeline (the different handlers that process the incoming network packets) uses an object parser that is prone to unsafe deserialization. An attacker can exploit the bug to send a malicious object and run it on the server.

A proof-of-concept shows the bug being exploited to load a gadget payload and run a DNS resolution command on the server. Like the code injection vulnerability, the deserialization bug also leads to pre-auth RCE.
Click to expand...

Key takeaways
“These vulnerabilities can affect default installations of Apache Storm. It is recommended to update as per the announcements,” Derek Dagit, member of the Apache Storm Project Management Committee (PMC), told The Daily Swig.

Regarding the code injection bug, Dagit said that the key takeaway is to treat any code that invokes an interpreter with scrutiny.

“The serialization vulnerability is harder to exploit, but its takeaway is simpler: In general, Java native serialization without registered types isn’t safe, neither as a default nor as a fallback,” he added.
Click to expand...

Log in or Sign up

Apache Storm maintainers patch two pre-auth RCE vulnerabilities

guest Guest

Log in or Sign up

Apache Storm maintainers patch two pre-auth RCE vulnerabilities

guest Guest

Useful Searches