CVE-2017-9799 Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user
HighCVSS 8.8
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.storm/storm-core(Maven) | = 1.1.0 | No fix listed |
| org.apache.storm/storm-core(Maven) | >= 1.0.0, < 1.0.4 | 1.0.4 |
| org.apache.storm/storm-core(Maven) | >= 1.1.0, < 1.1.1 | 1.1.1 |
| org.apache.storm/storm-core(Maven) | = 1.0.0 | No fix listed |
| org.apache.storm/storm-core(Maven) | = 1.0.1 | No fix listed |
| org.apache.storm/storm-core(Maven) | = 1.0.2 | No fix listed |
| org.apache.storm/storm-core(Maven) | = 1.0.3 | No fix listed |
| apache storm | = 1.0 | No fix listed |
| apache storm | = 1.0.1 | No fix listed |
| apache storm | = 1.0.2 | No fix listed |
| apache storm | = 1.0.3 | No fix listed |
| apache storm | = 1.1 | No fix listed |
| Apache Storm | = 1.0.0 through 1.0.3 | No fix listed |
| Apache Storm | = 1.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- lists.apache.org
- 100235 third-party-advisory vdb-entry
- 1039116 third-party-advisory vdb-entry
- [dev] 20170809 [CVE-2017-9799] Apache Storm Possible Code Execution As A Different User mailing-list