Apache Storm vulnerabilities

In Apache Storm before 3.1.0, a vulnerability exists: the Netty decoder is installed before authentication and processes frames without verification, allowing an unauthenticated attacker to allocate large buffers and potentially cause memory pressure on workers.

In Apache Storm before 3.1.0, the getNimbusConf function returns full configuration without redaction, and the UI endpoint /api/v1/cluster/configuration lacks proper authorization, potentially exposing passwords and keys.

In Apache Storm before 3.1.0, the rebalance operation does not revalidate the blobstore map for permissions, and listBlobs lacks authorization checks, allowing an authorized user to access disallowed blobs and disclose metadata.

This vulnerability in Apache Storm affects the `storm jar --artifacts` feature, where dependency artifacts are stored under a blob key derived solely from the Maven coordinate, making it predictable and shared across all users. If the blob already exists, it is silently reused without owner verification, allowing an attacker to control the data that other submitters receive, leading to code execution in another tenant's topology.

A vulnerability in Apache Storm allows an attacker to use relative path segments (../) in the `topology.blobstore.map` to force deletion and symlink creation at arbitrary locations, acting as the supervisor user. This can lead to recursive deletion of data and replacement of symlinks, which when workers are launched enables execution of attacker-chosen code as another tenant's OS user, breaking isolation.

A vulnerability in Apache Storm allows an authenticated user with topology submission rights to specify any server-side path as the topology jar, bypassing the intended file upload flow. Nimbus opens the path without verifying it was uploaded, enabling access to files readable by the Nimbus daemon user.

Vulnerability in Apache Storm allows unauthorized users to read credential data (e.g., storm.zookeeper.auth.payload, keystore/truststore passwords) via the topology API, because Nimbus daemon configuration is merged with topology configuration and returned without redaction.

The DRPC server in Apache Storm keeps a map from function names to request queues, and entries are never removed. An attacker can send arbitrary function names without authentication (as `drpc.authorizer` is disabled by default), leading to unbounded memory growth and eventual heap exhaustion.

Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.

The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.