CVE-2017-9799 Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user

What is CVE-2017-9799?

CVE-2017-9799 is a high-severity vulnerability in Apache Storm, published on 9 Aug 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.

Which versions are affected by CVE-2017-9799?

4 open source packages ship an affected version, including org.apache.storm:storm-core. It affects 1 product.

Products include Apache Storm.

How do I fix CVE-2017-9799?

Upgrade org.apache.storm:storm-core to a fixed version for your release line: 1.0.4 or 1.1.1.

Is CVE-2017-9799 being exploited?

There is no known exploitation of CVE-2017-9799 in the wild and no public exploit code.

Other vulnerabilities in Apache Storm

• CVE-2021-38294 Shell Command Injection Vulnerability in Nimbus Thrift Server Critical 9.8
• CVE-2021-40865 Unsafe Pre-Authentication Deserialization In Workers Critical 9.8
• CVE-2018-11779 Deserialization of Untrusted Data in Apache Storm Critical 9.8
• CVE-2015-3188 Apache Storm remote code execution vulnerability Critical 9.8
• CVE-2026-35337 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x825-rjww-2245, SUSE-SU-2017:3000-1.