CVE-2021-40865 Unsafe Pre-Authentication Deserialization In Workers

What is CVE-2021-40865?

CVE-2021-40865 is a critical unsafe deserialization vulnerability in Apache Storm, published on 25 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Weakness: CWE-502

Which versions are affected by CVE-2021-40865?

6 open source packages ship an affected version, including org.apache.storm:storm. It affects 1 product.

Products include Apache Storm.

How do I fix CVE-2021-40865?

Upgrade org.apache.storm:storm to a fixed version for your release line: 1.2.4, 2.1.1 or 2.2.1.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2021-40865 being exploited?

There is no known exploitation of CVE-2021-40865 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Apache Storm

• CVE-2021-38294 Shell Command Injection Vulnerability in Nimbus Thrift Server Critical 9.8
• CVE-2018-11779 Deserialization of Untrusted Data in Apache Storm Critical 9.8
• CVE-2015-3188 Apache Storm remote code execution vulnerability Critical 9.8
• CVE-2026-35337 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling High 8.8
• CVE-2018-1331 Code execution in org.apache.storm:storm-core High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w729-7633-2fw5.