TI-2021-15907 Aliases CVE-2021-38294 GHSA-6768-mcjc-8223

Shell Command Injection Vulnerability in Nimbus Thrift Server

HIGH 83CWE-74Published 2021-10-25 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Why it matters now

EPSS 0.83805 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Apache Storm (Apache Software Foundation): v1.2.4org.apache.storm:storm (Maven): 2.2.1, 2.1.1, 1.2.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Storm	v1.0.0 and later	—	No fix listed	CNA
Apache	Apache Storm	Apache Storm to before v1.2.4	v1.2.4	Patch available	CNA
—	org.apache.storm:storm (Maven)	2.2.0 to before 2.2.1	2.2.1	Patch available	GHSA-6768-mcjc-8223
—	org.apache.storm:storm (Maven)	2.0.0 to before 2.1.1	2.1.1	Patch available	GHSA-6768-mcjc-8223
—	org.apache.storm:storm (Maven)	1.0.0 to before 1.2.4	1.2.4	Patch available	GHSA-6768-mcjc-8223

Apache Storm VendorApache Affected v1.0.0 and later Fixed in — No fix listed CNA
Apache Storm VendorApache Affected Apache Storm to before v1.2.4 Fixed in v1.2.4 Patch available CNA
org.apache.storm:storm (Maven) Vendor— Affected 2.2.0 to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-6768-mcjc-8223
org.apache.storm:storm (Maven) Vendor— Affected 2.0.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-6768-mcjc-8223
org.apache.storm:storm (Maven) Vendor— Affected 1.0.0 to before 1.2.4 Fixed in 1.2.4 Patch available GHSA-6768-mcjc-8223

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:storm::::::::	1.0.0 to before 1.2.4; 2.1.0 to before 2.1.1; 2.2.0 to before 2.2.1	Vulnerable	Apache

cpe:2.3:a:apache:storm:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.2.4; 2.1.0 to before 2.1.1; 2.2.0 to before 2.2.1 Vulnerable ·Apache

Remediation

Fix · CNA Apache Storm (Apache Software Foundation) Fixed in v1.2.4
Fix · GHSA-6768-mcjc-8223 org.apache.storm:storm (Maven) Fixed in 2.2.1 Advisory →
Fix · GHSA-6768-mcjc-8223 org.apache.storm:storm (Maven) Fixed in 2.1.1 Advisory →
Fix · GHSA-6768-mcjc-8223 org.apache.storm:storm (Maven) Fixed in 1.2.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-38294
2026-10-03 Alias added: GHSA-6768-mcjc-8223

References

Exploit 1

http://packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html

Advisory 3

Other 1

https://github.com/apache/storm

TI-2021-17787 Unsafe Pre-Authentication Deserialization In Workers CVSS 3.1CRITICAL 9.8
TI-2015-02819 The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to… CVSS 3.0CRITICAL 9.8
TI-2018-08436 Deserialization of untrusted data in Apache Storm CVSS 3.0CRITICAL 9.8
TI-2017-07179 It was found that under some situations and configurations of Apache Storm 1.x before… CVSS 3.0HIGH 8.8
TI-2018-01232 In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and… CVSS 3.0HIGH 8.8
TI-2026-27475 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling CVSS 3.1HIGH 8.8

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences