Apache Storm Nimbus
Monthly
Apache Storm 3.0.0 through 3.1.0 (excluding 3.1.0) lets a topology submitter control the local destination name of each localized blob via the topology.blobstore.map setting, and the Nimbus/supervisor code builds that destination path without normalization and force-deletes whatever already exists before creating a symlink. Using ../ segments, a submitter can therefore cause recursive deletion of arbitrary supervisor-owned files and plant a symlink that makes a later worker launch execute attacker-chosen code as another tenant's OS user, defeating the isolation that supervisor.run.worker.as.user is meant to enforce. No public exploit code or CISA KEV listing was found at time of analysis, and SSVC records exploitation status as none with automatable set to no; the patch is Apache Storm 3.1.0.
Authenticated topology submission in Apache Storm Nimbus 3.0.0 through 3.0.x allows any authenticated Storm user to read arbitrary files accessible to the Nimbus daemon by supplying a server-side path as the uploadedJarLocation argument to submitTopology or submitTopologyWithOpts, bypassing the intended beginFileUpload flow entirely. Nimbus copies the targeted file into a topology blob and automatically grants the submitter read access via blob ACLs, enabling retrieval of Kerberos keytabs, TLS private keys, and ZooKeeper credentials through standard blob download APIs. A proof of concept was submitted alongside disclosure; upgrade to Apache Storm 3.1.0 is the required remediation.
Apache Storm 3.0.0 through 3.1.0 (excluding 3.1.0) lets a topology submitter control the local destination name of each localized blob via the topology.blobstore.map setting, and the Nimbus/supervisor code builds that destination path without normalization and force-deletes whatever already exists before creating a symlink. Using ../ segments, a submitter can therefore cause recursive deletion of arbitrary supervisor-owned files and plant a symlink that makes a later worker launch execute attacker-chosen code as another tenant's OS user, defeating the isolation that supervisor.run.worker.as.user is meant to enforce. No public exploit code or CISA KEV listing was found at time of analysis, and SSVC records exploitation status as none with automatable set to no; the patch is Apache Storm 3.1.0.
Authenticated topology submission in Apache Storm Nimbus 3.0.0 through 3.0.x allows any authenticated Storm user to read arbitrary files accessible to the Nimbus daemon by supplying a server-side path as the uploadedJarLocation argument to submitTopology or submitTopologyWithOpts, bypassing the intended beginFileUpload flow entirely. Nimbus copies the targeted file into a topology blob and automatically grants the submitter read access via blob ACLs, enabling retrieval of Kerberos keytabs, TLS private keys, and ZooKeeper credentials through standard blob download APIs. A proof of concept was submitted alongside disclosure; upgrade to Apache Storm 3.1.0 is the required remediation.