CVE-2021-38294
Shell Command Injection Vulnerability in Nimbus Thrift Server
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
Se presenta una vulnerabilidad de inyección de comandos en el servicio getTopologyHistory de Apache Storm versiones 2.x anteriores a 2.2.1 y Apache Storm versiones 1.x anteriores a 1.2.4. Una petición especialmente diseñada al servidor Nimbus permite una ejecución de código remota (RCE) antes de la autenticación
*Credits:
Apache Storm would like to thank @pwntester Alvaro Muñoz of the GitHub Security Lab team for reporting this issue.
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-08-09 CVE Reserved
- 2021-10-25 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2024-10-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
https://seclists.org/oss-sec/2021/q4/44 | Mailing List | |
https://securitylab.github.com/advisories/GHSL-2021-085-apache-storm |
URL | Date | SRC |
---|---|---|
http://packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html | 2024-08-04 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Apache Search vendor "Apache" | Storm Search vendor "Apache" for product "Storm" | >= 1.0.0 < 1.2.4 Search vendor "Apache" for product "Storm" and version " >= 1.0.0 < 1.2.4" | - |
Affected
| ||||||
Apache Search vendor "Apache" | Storm Search vendor "Apache" for product "Storm" | >= 2.1.0 < 2.1.1 Search vendor "Apache" for product "Storm" and version " >= 2.1.0 < 2.1.1" | - |
Affected
| ||||||
Apache Search vendor "Apache" | Storm Search vendor "Apache" for product "Storm" | >= 2.2.0 < 2.2.1 Search vendor "Apache" for product "Storm" and version " >= 2.2.0 < 2.2.1" | - |
Affected
|