Apache Storm up to 2.5.x on Unix TopologySpoutLag.java File.createTempFile temp file

Summaryinfo

A vulnerability has been found in Apache Storm up to 2.5.x on Unix and classified as problematic. This affects the function File.createTempFile of the file TopologySpoutLag.java. This manipulation causes temp file. This vulnerability is tracked as CVE-2023-43123. The attack is restricted to local execution. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Apache Storm up to 2.5.x on Unix. It has been declared as problematic. Affected by this vulnerability is the function File.createTempFile of the file TopologySpoutLag.java. The manipulation with an unknown input leads to a temp file vulnerability. The CWE definition for the vulnerability is CWE-378. Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack. As an impact it is known to affect confidentiality. The summary by CVE is:

On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method File.createTempFile on unix-like systems creates a file with predefined name (so easily identifiable) and by default will create this file with the permissions -rw-r--r--. Thus, if sensitive information is written to this file, other local users can read this information. File.createTempFile(String, String) will create a temporary file in the system temporary directory if the 'java.io.tmpdir' system property is not explicitly set. This affects the class  https://github.com/apache/storm/blob/master/storm-core/src/jvm/org/apache/storm/utils/TopologySpoutLag.java#L99  and was introduced by  https://issues.apache.org/jira/browse/STORM-3123 In practice, this has a very limited impact as this class is used only if ui.disable.spout.lag.monitoring is set to false, but its value is true by default. Moreover, the temporary file gets deleted soon after its creation. The solution is to use  Files.createTempFile https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/nio/file/Files.html#createTempFile(java.lang.String,java.lang.String,java.nio.file.attribute.FileAttribute...)  instead. We recommend that all users upgrade to the latest version of Apache Storm.

The weakness was disclosed 11/23/2023 by Andrea Cosentino. It is possible to read the advisory at lists.apache.org. This vulnerability is known as CVE-2023-43123 since 09/18/2023. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 276126 (TencentOS Server 4: storm (TSSA-2024:1013)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.6.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (276126). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Apache

Name

• Storm

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion