Description<\/p>\n
A topology’s `topology.blobstore.map` lets the submitter choose a local name for each blob that the
\nsupervisor localises. That name was used to build a path under the topology’s working directory without
\nnormalisation, in both `AsyncLocalizer` and `Container.createBlobstoreLinks`, and the symlink helper
\nforce-deletes whatever already exists at the target before creating the link.<\/p>\n
A submitter could therefore use `..\/` segments to direct that delete-and-symlink operation at an arbitrary
\npath, as the supervisor user, on every node the topology is scheduled onto. The consequences include
\nrecursive deletion of supervisor-owned content and planting a symlink that causes a subsequent worker
\nlaunch to execute attacker-chosen code as another tenant’s operating-system user, which defeats the
\nisolation that `supervisor.run.worker.as.user` is intended to provide.<\/p>\n
Mitigation<\/p>\n
Upgrade to 3.1.0, where the resolved target must lie inside the expected root at both call sites.<\/p>\n
Users who cannot upgrade immediately should restrict topology submission to trusted principals, and may
\nreject submissions whose `topology.blobstore.map` entries contain path separators or `..` segments before
\nthey reach Nimbus.<\/p>\n
Credit<\/p>\n
The ASF — found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.<\/p>\n","protected":false},"excerpt":{"rendered":"
Description<\/p>\n
A topology’s `topology.blobstore.map` lets the submitter choose a local name for each blob that the
\nsupervisor localises. That name was used to build a path under the topology’s working d<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-22312","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/22312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=22312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=22312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=22312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}