Path Traversal in Apache Storm Blobstore Map Enables Arbitrary Deletion, Cross-Tenant RCE
AI analysis
Apache Storm prior to 3.1.0 does not normalize the local file name a topology submitter chooses in 'topology.blobstore.map', and uses that name to build a path under the topology's working directory in both AsyncLocalizer and Container.createBlobstoreLinks, where the symlink helper force-deletes whatever already exists at the target before creating the link. By embedding '../' segments in a blob's local name, a submitter can direct this delete-and-symlink operation at arbitrary paths, running as the supervisor user, on every node the topology is scheduled onto. The consequences include recursive deletion of supervisor-owned content and planting a symlink that makes a subsequent worker launch execute attacker-chosen code as another tenant's operating-system user, defeating the isolation that 'supervisor.run.worker.as.user' is intended to provide. Any organization running a pre-3.1.0 cluster where less-than-fully-trusted users or services can submit topologies — especially multi-tenant clusters — is affected, though the flaw requires submitter access rather than mere network reachability. No exploitation is known, no public proof of concept exists, the CVE is not in CISA's KEV, and a CVSS score has not yet been assigned.
What to do: Upgrade to Apache Storm 3.1.0, where the resolved target must lie inside the expected root at both vulnerable call sites. If you cannot upgrade immediately, restrict topology submission to trusted principals and reject submissions whose 'topology.blobstore.map' entries contain path separators or '..' segments before they reach Nimbus. Check supervisor nodes for unexpected recursive deletions of supervisor-owned content or planted symlinks under topology working directories, and treat any findings as a potential tenant-isolation compromise.
Affected
| Apache Software Foundation Storm | All versions prior to 3.1.0 (fixed in 3.1.0) |
Estimated exposure
moderateOn the order of a few thousand Storm clusters worldwide (likely 1,000–10,000 deployments), with only the multi-tenant or untrusted-submitter subset practically… — Apache Storm is self-hosted big-data middleware with no active-install telemetry, public internet scans typically surface only low thousands of Storm endpoints, and most deployments run on internal networks where the bug still requires…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both `AsyncLocalizer` and `Container.createBlobstoreLinks`, and the symlink helper force-deletes whatever already exists at the target before creating the link. A submitter could therefore use `../` segments to direct that delete-and-symlink operation at an arbitrary path, as the supervisor user, on every node the topology is scheduled onto. The consequences include recursive deletion of supervisor-owned content and planting a symlink that causes a subsequent worker launch to execute attacker-chosen code as another tenant's operating-system user, which defeats the isolation that `supervisor.run.worker.as.user` is intended to provide. Mitigation Upgrade to 3.1.0, where the resolved target must lie inside the expected root at both call sites. Users who cannot upgrade immediately should restrict topology submission to trusted principals, and may reject submissions whose `topology.blobstore.map` entries contain path separators or `..` segments before they reach Nimbus. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.