Description<\/p>\n
Dependency artifacts uploaded with `storm jar –artifacts` were stored under a blob key derived only from
\nthe Maven coordinate, for example `dep—.jar`. The key was therefore identical
\nfor every user of the cluster and predictable in advance. When the blob already existed, the uploader
\ncaught `KeyAlreadyExistsException` and silently reused it, with no check that the existing blob’s content
\nor owner matched the artifact the submitter had resolved.<\/p>\n
A user who uploaded a blob under such a key first therefore controlled the bytes that every later submitter
\nof the same coordinate would receive on the worker classpath, resulting in code execution inside another
\ntenant’s topology.<\/p>\n
This affects deployments where more than one principal may create blobs and where the `–artifacts`
\ndependency feature is used.<\/p>\n
Mitigation<\/p>\n
Upgrade to 3.1.0, where each uploaded artifact receives a key carrying a freshly generated UUID and a
\npre-existing blob is no longer silently reused.<\/p>\n
Note that the corrected key generation is on the SUBMITTING CLIENT, so upgrading the cluster alone does not
\nclose this; every client that runs `storm jar –artifacts` must also be upgraded. Operators should audit
\nexisting `dep-` blobs for unexpected owners before upgrading. Users who cannot upgrade immediately should
\navoid the `–artifacts` mechanism in multi-tenant clusters and distribute dependencies inside the topology
\njar instead.<\/p>\n
Credit<\/p>\n
The ASF — found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.<\/p>\n","protected":false},"excerpt":{"rendered":"
Description<\/p>\n
Dependency artifacts uploaded with `storm jar –artifacts` were stored under a blob key derived only from
\nthe Maven coordinate, for example `dep—.jar`. The key was therefore identical
\nf<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-22313","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/22313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=22313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=22313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=22313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}