Unsafe Pre-Authentication Deserialization In Workers

Vulnerability

The Apache Storm supervisor server contains an unsafe deserialization vulnerability in its worker services [1]. This flaw exists across multiple version lines: Storm 2.2.x (before 2.2.1 or 2.3.0), Storm 2.1.x (before 2.1.1), and Storm 1.x (before 1.2.4) [1]. The vulnerable code path is reachable without any prior authentication.

Exploitation

An attacker can exploit this vulnerability by sending a crafted serialized object to the supervisor server worker services [1]. No authentication is required to reach the vulnerable endpoint, meaning the attack can be performed from any network position that can communicate with the Storm supervisor server.

Impact

Successful exploitation leads to pre-authentication remote code execution (RCE) on the Apache Storm supervisor server [1]. The attacker gains the ability to execute arbitrary code with the privileges of the Storm process, potentially compromising the entire Storm cluster.

Mitigation

Users should upgrade to the fixed versions: Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0; Apache Storm 2.1.x users should upgrade to version 2.1.1; Apache Storm 1.x users should upgrade to version 1.2.4 [1]. No workarounds are mentioned in the available reference.