Arbitrary File Write Vulnerability in Apache Storm Affects Multiple Versions

CVE-2018-8008

Summary

The vulnerability in Apache Storm versions 1.0.6 and earlier, 1.1.2 and earlier, and 1.2.1 and earlier allows attackers to exploit an arbitrary file write issue through specially crafted zip archives. This security flaw enables path traversal by manipulating filenames within the archive, which can lead to the extraction of files to unintended locations on the server. The vulnerability is not limited to zip files; it also impacts other archive formats such as bzip2, tar, xz, war, cpio, and 7z. Ensuring that your Apache Storm installations are updated is crucial to mitigate potential risks.

References