Cross-site Request Forgery (CSRF) Affecting org.apache.storm:storm-core package, versions [,0.10.0-beta)
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Cross-site Request Forgery (CSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-ORGAPACHESTORM-8663323
- published27 Jan 2025
- disclosed26 Jan 2025
- creditUnknown
Introduced: 26 Jan 2025
New CVE NOT AVAILABLE CWE-352 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade org.apache.storm:storm-core to version 0.10.0-beta or higher.
Overview
org.apache.storm:storm-core is a distributed realtime computation system.
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the Storm UI component due to improper user input sanitization.
PoC
Sending the following request will result in killing the topology:
http://storm-ui-root/api/v1/topology/storm-6-1406915499/kill/30