CVE-2021-38294: A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A…

PriorityP183critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

84.49%

99.7th percentile

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
apache	storm	>= 1.0.0 < 1.2.4	1.2.4
apache	storm	>= 2.1.0 < 2.1.1	2.1.1
apache	storm	>= 2.2.0 < 2.2.1	2.2.1
apache_software_foundation	apache_storm	>= Apache Storm < v1.2.4	v1.2.4
apache_software_foundation	apache_storm	>= v1.0.0 < Apache Storm*	Apache Storm*

Detection & IOCsextracted from sources · hover to see the quote

port6627↗

othergetTopologyHistory↗

→Monitor for specially crafted Thrift RPC requests to the Nimbus server targeting the getTopologyHistory method, particularly with shell metacharacters in the user argument field. ↗
→The vulnerable RPC method concatenates the user argument directly into a bash command string — detect shell metacharacters (e.g., ;, |, $(), backticks) in the user parameter of getTopologyHistory Thrift calls. ↗
→Exploitation requires at least one topology (active or inactive) to have been previously submitted to the Storm cluster — correlate getTopologyHistory exploitation attempts with topology submission history. ↗
→Successful exploitation results in process execution as the Storm service account — monitor for unexpected child processes spawned by the Nimbus/Storm process. ↗
→The exploit was confirmed working against Apache Storm 2.2.0 — prioritize detection on environments running Storm 2.x prior to 2.2.1 and 1.x prior to 1.2.4. ↗

·The vulnerability is pre-authentication — no valid credentials are required to trigger RCE, meaning standard auth-based detection will not catch exploitation attempts. ↗
·Exploitation is only possible if at least one topology has been submitted to the cluster (active or inactive); environments with no topologies are not exploitable. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.