GitHub Advisory DatabaseGHSA-XM2M-2Q6H-22JWApache NiFi vulnerable to Code Injection
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.907 High
EPSS
Percentile
98.9%
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.
The resolution validates the Database URL and rejects H2 JDBC locations.
You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
Affected configurations
References
packetstormsecurity.com/files/174398/Apache-NiFi-H2-Connection-String-Remote-Code-Execution.html
www.openwall.com/lists/oss-security/2023/06/12/3
exceptionfactory.com/posts/2023/10/07/firsthand-analysis-of-apache-nifi-vulnerability-cve-2023-34468
github.com/advisories/GHSA-xm2m-2q6h-22jw
github.com/apache/nifi/commit/4faf3ea59895e7e153db3f8f61147ff70a254361
github.com/apache/nifi/pull/7349
issues.apache.org/jira/browse/NIFI-11653
lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8
nifi.apache.org/security.html#CVE-2023-34468
nvd.nist.gov/vuln/detail/CVE-2023-34468
www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.907 High
EPSS
Percentile
98.9%