K

An authenticated tenant can perform Server-Side Request Forgery (SSRF) by registering a template that points to a malicious metalink file containing internal targets, allowing the Secondary Storage VM to retrieve and persist this data. Additionally, a tenant with the default User role can achieve Remote Code Execution (RCE) as root on the KVM hypervisor host. This occurs when a user registers a VM template with the `directDownload` variable set to true and a URL pointing to a .metalink file; the management server fetches the XML and dispatches the download to the KVM agent without re-validating the inner URLs against the scheme allowlist.

When TLS transport is enabled without requiring client certificate authentication, the `TlsTransportPlugin` assigns a fallback principal (CN=ANONYMOUS) if no client certificate is presented or if verification fails. This occurs because the `SSLPeerUnverifiedException` is caught and suppressed instead of rejecting the connection. This fail-open behavior allows unauthenticated clients to establish a TLS connection and receive a valid principal identity. If the configured authorizer, such as `SimpleACLAuthorizer`, does not explicitly deny access to CN=ANONYMOUS, it may lead to unauthorized access to services. This condition is only logged at the debug level, which limits visibility in production environments.

Improper certificate validation occurs in the Prometheus Reporter when the `storm.daemon.metrics.reporter.plugin.prometheus.skip tls validation` configuration is enabled. The `PrometheusPreparableReporter` class utilizes an `INSECURE TRUST MANAGER` that accepts all SSL certificates without validation via empty `checkClientTrusted` and `checkServerTrusted` methods. When the aforementioned configuration is active, the `INSECURE CONNECTION FACTORY` executes `SSLContext.setDefault(sslContext)`, which replaces the default SSL context for the entire Java Virtual Machine (JVM) instead of limiting the insecure context to the Prometheus connection. Consequently, all HTTPS communications within the process, including ZooKeeper, Thrift, Netty, and UI connections, trust all certificates, including self-signed or attacker-generated ones, allowing for man-in-the-middle interception of administrative credentials, topology submissions, cluster state, and tuple data.

The Storm UI visualization component interpolates topology metadata, such as component IDs, stream names, and grouping values, directly into HTML via innerHTML in the `parseNode()` and `parseEdge()` functions without sanitization. An authenticated user with topology submission rights can craft a topology containing malicious HTML or JavaScript in component identifiers. This payload is transmitted through Nimbus, Thrift, and the Visualization API to the vis.js tooltip rendering, leading to stored cross-site scripting. In multi-tenant deployments, this can allow privilege escalation if the UI is accessed by operators or administrators.

The issue is related to an improper regular expression in Vue's `parseHTML` function, which can lead to a potential regular expression denial of service vulnerability. This flaw, known as a ReDoS (Regular expression Denial of Service), allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption. In a Vue client-side application, this vulnerability can be exploited by creating a new Vue instance with a template string that includes a `<script>` tag but closes it incorrectly. The time taken to parse and mount the Vue application increases significantly due to the ReDoS vulnerability, demonstrating how the flaw can affect performance.

A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the `data-slide` and `data-slide-to` attributes can be exploited through the `href` attribute of an <a> tag due to inadequate sanitization. This could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.

A security issue has been discovered that could enable Cross-Site Scripting (XSS) attacks. The issue is associated with the `data-loading-text` attribute within the button plugin. This can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.

A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the `data-slide` and `data-slide-to` attributes can be exploited through the href attribute of an `<a>` tag due to inadequate sanitization. This could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.

The issue allows remote attackers to bypass authentication and log in to the product with administrative privileges. The exact vectors used for the attack are not specified.