Shell Command Injection Vulnerability in Nimbus Thrift Server

published 2021-10-25 5 y ago modified 2026-06-17 4 mo ago also GHSA-6768-mcjc-8223 , EUVD-2021-2167

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 83.8%; EPSS 83.8% chance of exploitation in 30 days, percentile 99.6%
public exploits: 1; Metasploit

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Patch / fix

fixed in 2

maven org.apache.storm:storm 1.2.4, 2.1.1, 2.2.1
Apache Software Foundation Apache Storm v1.2.4, v2.1.1, v2.2.1, v2.3.0

Timeline

2021-10-25 First public exploit (Metasploit exploit/linux/misc/nimbus_gettopologyhistory_cmd_exec)
2021-10-25 Published

Exploit prediction

83.80% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/misc/nimbus_gettopologyhistory_cmd_exec Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution metasploit exploit, excellent rank, 2021-10-25
packetstormsecurity.com http://packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.storm:storm	>=2.2.0, <2.2.1 >=2.0.0, <2.1.1 >=1.0.0, <1.2.4	2.2.1 2.1.1 1.2.4

Affected products

Apache Software Foundation Apache Storm

Classification

Weakness

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

packetstormsecurity.com /files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html
web, exploit, third-party-advisory, vdb-entry
lists.apache.org /thread.html/r5fe881f6ca883908b7a0f005d35115af49f43beea7a8b0915e377859%40%3Cuser.storm.apache.org%3E
web, mailing-list, vendor-advisory
seclists.org /oss-sec/2021/q4/44
web, mailing-list, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-38294
advisory
github.com /apache/storm
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary