Description<\/p>\n
Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm’s HTTP
\ncomponents served to an authenticated user.<\/p>\n
The Logviewer reflected the request’s `Origin` header back in `Access-Control-Allow-Origin` while also
\nsending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive
\n`Access-Control-Allow-Origin: *` posture as accepted, which is safe precisely because browsers refuse to
\nhonour `*` together with credentials; reflecting the concrete origin removes that protection.<\/p>\n
The shared CORS filter used by the UI, the Logviewer and DRPC was configured with a response header name
\nwhere an initialisation parameter name was expected. The container ignored the setting and applied its own
\ndefaults, which allow credentials.<\/p>\n
Finally, the UI and Logviewer wrapped API responses in a caller-supplied JSONP callback for every GET
\nrequest. A script element on any origin can load such a response, which bypasses the same-origin policy
\nentirely rather than negotiating it, and there was no way to turn the behaviour off.<\/p>\n
In each case the effect is that a page visited by an authenticated operator can read cluster, topology and
\nlog data on their behalf.<\/p>\n
Mitigation<\/p>\n
Upgrade to 3.1.0, where the Logviewer no longer reflects the request origin in a credentialed response, the
\nCORS filter is configured explicitly, and JSONP wrapping is governed by `ui.enable.jsonp`, which defaults to
\nfalse.<\/p>\n
Note that disabling JSONP is a behaviour change for tooling that passes a `callback` query parameter; such
\ntooling should be moved to ordinary JSON requests.<\/p>\n
Users who cannot upgrade immediately should place the UI, Logviewer and DRPC HTTP endpoints behind a reverse
\nproxy that strips `Access-Control-Allow-Origin` and `Access-Control-Allow-Credentials` from responses and
\nrejects requests carrying a `callback` parameter.<\/p>\n
Credit<\/p>\n
The ASF — found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.<\/p>\n","protected":false},"excerpt":{"rendered":"
Description<\/p>\n
Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm’s HTTP
\ncomponents served to an authenticated user.<\/p>\n
The Logviewer reflected the request’s <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-22322","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/22322","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=22322"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=22322"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=22322"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}