A high-severity authorization vulnerability in Apache Storm Nimbus allows authenticated users to access sensitive blob data and bypass access controls, posing a significant risk to data confidentiality.

The vulnerability stems from improper authorization checks (CWE-863). The Nimbus component fails to re-validate configuration overrides during rebalance operations and lacks authorization checks for the listBlobs operation, enabling an authenticated user to access files they are not permitted to view.

This flaw carries a CVSS score of 8.1, indicating a high level of risk. Successful exploitation allows an authenticated attacker to gain unauthorized access to sensitive information stored within the blobstore, which could lead to the compromise of proprietary data, intellectual property, or internal configuration details. The potential for data exfiltration necessitates immediate attention to prevent unauthorized information disclosure.

Immediate Action: Upgrade to Apache Storm version 3.1.0 or later, where the rebalance configuration overrides are properly validated and authorization checks are enforced for the listBlobs operation.

Proactive Monitoring: Review access logs for the Nimbus Thrift port to identify unusual patterns in blob listing or rebalance requests from accounts with limited privileges.

Compensating Controls: Restrict rebalance rights to strictly trusted principals and ensure that memberships in topology users or groups are audited regularly to minimize the attack surface until the update is applied.

Public Exploit Available: No (exploit_available: false)

Given the high severity of this authorization bypass, security teams should prioritize the upgrade to version 3.1.0 in all production environments. Failure to address this vulnerability allows authenticated users to circumvent security boundaries, potentially exposing sensitive blob contents. Applying the vendor-provided patch is the only definitive method to eliminate this risk.