CVE-2021-38294: Apache Storm RCE Vulnerability

CVE-2021-38294 Overview

A Command Injection vulnerability exists in the getTopologyHistory service of Apache Storm. This flaw allows attackers to execute arbitrary commands on vulnerable Nimbus servers through specially crafted thrift requests, critically without requiring any prior authentication. The vulnerability affects Apache Storm 2.x prior to version 2.2.1 and Apache Storm 1.x prior to version 1.2.4.

Critical Impact

This pre-authentication remote code execution vulnerability allows unauthenticated attackers to completely compromise Apache Storm Nimbus servers, potentially leading to full cluster takeover, data exfiltration, and lateral movement within distributed computing environments.

Affected Products

• Apache Storm 2.x versions prior to 2.2.1
• Apache Storm 1.x versions prior to 1.2.4
• Apache Storm Nimbus server component

Discovery Timeline

• 2021-10-25 - CVE-2021-38294 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-38294

Vulnerability Analysis

This vulnerability represents a severe command injection flaw (CWE-78) in the Apache Storm Nimbus server's getTopologyHistory service. Apache Storm is a distributed real-time computation system used for processing unbounded streams of data, making it a critical component in many big data infrastructures.

The vulnerability stems from improper input validation in the thrift-based communication protocol used by the Nimbus server. When processing topology history requests, user-supplied input is incorporated into command execution without adequate sanitization. This allows an attacker to inject arbitrary operating system commands that execute with the privileges of the Storm Nimbus process.

What makes this vulnerability particularly dangerous is that exploitation occurs prior to authentication. Attackers with network access to the Nimbus server's thrift port can immediately achieve remote code execution without needing valid credentials or session tokens.

Root Cause

The root cause is classified as Injection (CWE-74) and OS Command Injection (CWE-78). The getTopologyHistory service fails to properly sanitize or validate user-controlled input before passing it to system command execution functions. This lack of input validation allows metacharacters and command separators to be interpreted by the underlying shell, enabling command injection attacks.

Attack Vector

The attack is network-based, requiring only TCP connectivity to the Apache Storm Nimbus server's thrift service port. The attack complexity is low, requiring no privileges, no user interaction, and no special conditions. An attacker sends a malicious thrift request to the Nimbus server containing injected OS commands within parameters intended for the getTopologyHistory function. The server processes this request and executes the embedded commands with full system access.

The exploitation mechanism involves crafting a thrift request that includes shell metacharacters and arbitrary commands within topology-related parameters. When the Nimbus server processes the request, the injected commands are executed in the context of the server process, potentially allowing attackers to establish reverse shells, exfiltrate sensitive data, or pivot to other systems within the network.

Detection Methods for CVE-2021-38294

Indicators of Compromise

• Unusual or malformed thrift requests to the Nimbus server containing shell metacharacters (;, |, &, backticks, $())
• Unexpected child processes spawned by the Storm Nimbus Java process
• Outbound network connections initiated by the Nimbus server to unknown external hosts
• Suspicious command execution patterns in system logs correlating with thrift request timestamps
• Presence of unauthorized files or scripts in Storm-related directories

Detection Strategies

• Monitor thrift traffic to Storm Nimbus servers for requests containing shell metacharacters or command injection patterns
• Implement network-level intrusion detection signatures for malformed getTopologyHistory requests
• Deploy endpoint detection and response (EDR) solutions to monitor for anomalous process creation chains from Java processes
• Enable comprehensive logging on Storm Nimbus servers and correlate with SIEM platforms
• Use SentinelOne's behavioral AI to detect post-exploitation activities such as reverse shell establishment or privilege escalation attempts

Monitoring Recommendations

• Configure alerting for any external network connections originating from Storm Nimbus processes
• Implement baseline monitoring for normal topology history request patterns and alert on deviations
• Monitor file system integrity on Storm Nimbus servers for unauthorized modifications
• Track authentication failures and successful anonymous connections to thrift services

How to Mitigate CVE-2021-38294

Immediate Actions Required

• Upgrade Apache Storm 2.x installations to version 2.2.1 or later immediately
• Upgrade Apache Storm 1.x installations to version 1.2.4 or later immediately
• Restrict network access to Storm Nimbus thrift ports to only authorized clients using firewall rules
• Implement network segmentation to isolate Storm clusters from untrusted networks
• Review system logs for evidence of prior exploitation attempts

Patch Information

Apache has released patched versions that address this command injection vulnerability. Organizations should upgrade to Apache Storm 2.2.1 or later for 2.x deployments, or Apache Storm 1.2.4 or later for 1.x deployments. The security advisory is available through the Apache Mailing List Discussion. Additional technical details regarding the vulnerability and exploitation can be found in the Packet Storm Exploit Report and the OSS Security Mailing List Post.

Workarounds

• Implement strict network access controls limiting connectivity to Storm Nimbus thrift ports to trusted internal hosts only
• Deploy a Web Application Firewall (WAF) or network IPS with rules to filter malicious thrift requests containing injection patterns
• Consider running Storm Nimbus in a containerized environment with restricted capabilities and network policies
• Implement authentication proxies in front of Storm services as an additional layer of defense
• Monitor and rate-limit connections to the Nimbus thrift service to reduce exploitation window

# Example: Restrict Nimbus port access using iptables
# Allow only trusted internal network to access Storm Nimbus thrift port (default 6627)
iptables -A INPUT -p tcp --dport 6627 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 6627 -j DROP

# Verify Storm version to ensure patched version is deployed
storm version