Executive brief
Apache Storm is an open-source distributed real-time computation system used to process large data streams. Multiple cross-origin request handling flaws in Storm's HTTP components allow an attacker to trick an authenticated operator into visiting a malicious web page, which can then silently read sensitive cluster, topology, and log data from the victim's authenticated session—potentially exposing operational details and logs without the operator's knowledge or consent.
Technical details
The vulnerability comprises three distinct CORS and same-origin policy bypass mechanisms: (1) the Logviewer reflects the request Origin header into Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true, removing the browser protection normally afforded by wildcard CORS policies; (2) a shared CORS filter used across the UI, Logviewer, and DRPC is misconfigured with an initialization parameter name instead of a response header name, causing the container to ignore the setting and apply permissive defaults that allow credentials; and (3) both UI and Logviewer wrap API responses in caller-supplied JSONP callbacks for all GET requests without restriction, allowing any origin to bypass same-origin policy entirely. All three flaws enable a page visited by an authenticated operator to exfiltrate cluster, topology, and log data on their behalf. The fix is available in version 3.1.0 and addresses all three mechanisms; users unable to upgrade should place affected endpoints behind a reverse proxy that strips CORS headers and rejects callback parameters.
Affected products
- Apache Storm before 3.1.0
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in version 3.1.0