A critical deserialization vulnerability in Apache Storm allows authenticated users to execute arbitrary code on Nimbus and Worker JVMs.

This is a deserialization of untrusted data flaw (CWE-502) occurring when the system processes topology credentials. An authenticated user with topology submission rights can supply a malicious serialized object to the TGT credential field, which is then processed by an insecure ObjectInputStream.

The ability for an attacker to achieve remote code execution poses a severe risk to the confidentiality, integrity, and availability of the entire Apache Storm cluster. With a CVSS score of 8.8, this vulnerability allows for full system compromise, potentially leading to unauthorized data access, lateral movement within the network, and complete service disruption.

Immediate Action: Upgrade the Apache Storm Client to version 2.8.6 or later to apply the necessary class filtering and validation.

Proactive Monitoring: Monitor Nimbus and Worker JVM logs for unexpected errors related to deserialization or unauthorized access attempts against the Thrift API.

Compensating Controls: If an immediate upgrade is not feasible, implement a monkey-patch to the ClientAuthUtils.deserializeKerberosTicket method to restrict deserialized classes to an explicit allow-list, as detailed in the version 2.8.6 release notes.

Public Exploit Available: Unknown

Given the potential for remote code execution, organizations running Apache Storm should prioritize patching to version 2.8.6 immediately. If immediate patching is not possible, the provided workaround involving the implementation of an object filter is essential to prevent exploitation by authenticated users.