title: Shell Command Injection Vulnerability in Nimbus Thrift Server
description: A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
problem types: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
affected:
{
platforms: Non-Windows
product: Apache Storm
vendor: Apache Software Foundation
versions:
lessThan: Apache Storm*, status: affected, version: v1.0.0, versionType: custom
}
{
product: Apache Storm
vendor: Apache Software Foundation
versions:
changes: [at: v2.1.1, status: unaffected], lessThan: v1.2.4, status: affected, version: Apache Storm, versionType: custom
}
metrics:
other: [
content: {'other': 'high'}
type: unknown
]
workarounds: Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0
Apache Storm 2.1.x users should upgrade to version 2.1.1
Apache Storm 1.x users should upgrade to version 1.2.4