AI analysis
Apache Storm before 3.1.0 leaks its full daemon configuration, including the ZooKeeper authentication payload (storm.zookeeper.auth.payload) and the TLS keystore/truststore passwords for Thrift, Netty, and ZooKeeper, through two paths: the Nimbus getNimbusConf call, which returns credentials unredacted after only a user-level authorization check, and the UI REST endpoint /api/v1/cluster/configuration, which applied no per-user check at all because it lacked an @AuthNimbusOp annotation and the filter treated a missing annotation as requiring no gate, proxying the request under the UI daemon's own principal. Any user who can pass the UI's ui.filter authentication can trigger the UI path and retrieve secrets that Nimbus itself would have refused to share. An attacker gains Kerberos/TLS credentials and ZooKeeper auth material that could allow impersonating cluster components and further compromise of the Storm cluster and its ZooKeeper ensemble. All Apache Storm deployments prior to 3.1.0 are affected where those credentials are configured. No public proof of concept exists and no exploitation in the wild is known.
What to do: Upgrade to Apache Storm 3.1.0, which masks credential-bearing configuration values and requires explicit authorization declarations on every UI API endpoint. If you cannot upgrade immediately, place the Storm UI behind an authenticating reverse proxy that restricts /api/v1/cluster/configuration, and review UI access logs for requests to that endpoint. Rotate the ZooKeeper authentication payload and any Thrift, Netty, or ZooKeeper TLS keystore/truststore passwords that were reachable through the exposed endpoints.
Affected
| Apache Storm (Nimbus daemon and Storm UI) | all versions prior to 3.1.0 (fixed in 3.1.0) |
Estimated exposure
moderatelikely on the order of a few thousand enterprise Storm clusters worldwide, with only a subset (likely hundreds) internet-exposed — Apache Storm is an enterprise big-data/stream-processing framework typically deployed inside corporate networks, and public internet scans historically show only a few hundred exposed Storm UI instances, so the reachable population is…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes `storm.zookeeper.auth.payload` and the keystore and truststore passwords for the Thrift, Netty and ZooKeeper TLS configuration. The project masks passwords elsewhere before display, so the omission here is inconsistent rather than intended. The UI endpoint `/api/v1/cluster/configuration` compounded this. It carried no `@AuthNimbusOp` annotation, and the authorization filter treated a missing annotation as "no gate required" and returned immediately, so the endpoint applied no per-user check at all and proxied the request under the UI daemon's own principal. Any user able to pass `ui.filter` therefore received the full configuration, including principals that Nimbus itself would have refused. Mitigation Upgrade to 3.1.0, where credential-bearing values are masked before the configuration is served and where every UI API endpoint must declare its authorization explicitly. Users who cannot upgrade immediately should place the UI behind an authenticating reverse proxy that restricts `/api/v1/cluster/configuration`, and should rotate the ZooKeeper authentication payload and any TLS keystore or truststore passwords that were reachable through it. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.