Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14bTJtLTJxNmgtMjJqd84AAzyM

Apache NiFi vulnerable to Code Injection

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Permalink: https://github.com/advisories/GHSA-xm2m-2q6h-22jw
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14bTJtLTJxNmgtMjJqd84AAzyM
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: 7 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-xm2m-2q6h-22jw, CVE-2023-34468
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-34468
• https://lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8
• https://nifi.apache.org/security.html#CVE-2023-34468
• https://github.com/apache/nifi/pull/7349
• https://github.com/apache/nifi/commit/4faf3ea59895e7e153db3f8f61147ff70a254361
• https://issues.apache.org/jira/browse/NIFI-11653
• http://www.openwall.com/lists/oss-security/2023/06/12/3
• http://packetstormsecurity.com/files/174398/Apache-NiFi-H2-Connection-String-Remote-Code-Execution.html
• https://exceptionfactory.com/posts/2023/10/07/firsthand-analysis-of-apache-nifi-vulnerability-cve-2023-34468
• https://www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation
• https://github.com/advisories/GHSA-xm2m-2q6h-22jw

Repository: https://github.com/apache/nifi
Blast Radius: 16.9

Affected Packages