Apache Storm Webapp versions 3.0.0 up to but not including 3.1.0 contain an origin validation vulnerability (CWE-346) in their HTTP components. The Logviewer improperly reflects the request's Origin header in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true, breaking the intended security model that relies on Access-Control-Allow-Origin: *. Additionally, a shared CORS filter is misconfigured, causing the container to apply defaults that allow credentials. Finally, the UI and Logviewer wrap API responses in JSONP callbacks for all GET requests without an option to disable this behavior, allowing cross-origin script elements to bypass same-origin policy protections. These combined issues allow a web page on an unrelated origin to read sensitive data on behalf of an authenticated user. The vulnerability is addressed in Apache Storm 3.1.0 by removing origin reflection in credentialed responses, explicitly configuring the CORS filter, and disabling JSONP wrapping by default via the ui.enable.jsonp setting. Users who cannot upgrade immediately are advised to place affected HTTP endpoints behind a reverse proxy that strips the problematic headers and rejects requests with callback parameters.

An attacker controlling a web page on an unrelated origin can read sensitive cluster, topology, and log data from Apache Storm Webapp HTTP components on behalf of an authenticated operator. This breaks the same-origin policy protections and exposes potentially sensitive operational information. The impact is limited to authenticated users and requires the victim to visit a malicious web page.

Upgrade Apache Storm to version 3.1.0 or later, where the Logviewer no longer reflects the request origin in credentialed responses, the CORS filter is explicitly configured to prevent credential leakage, and JSONP wrapping is disabled by default (ui.enable.jsonp=false). For users unable to upgrade immediately, deploy a reverse proxy in front of the UI, Logviewer, and DRPC HTTP endpoints that strips Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers from responses and rejects requests containing a callback parameter to block JSONP requests. Tooling relying on JSONP callbacks should be updated to use standard JSON requests.