CVE-2023-34468

CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC 一个简短的 Python PoC，用于滥用可编辑的 Apache NiFi ExecuteSQL 处理器，通过 H2 RUNSCRIPT 负载触发远程命令执行，并通过 Bash 反向 shell 建立连接。 仅用于授权测试和研究。请勿对你不拥有或未经明确许可测试的系统使用。 功能 root@kitploit: ExecuteSQL processor update - H2 RUNSCRIPT fetch - Bash reverse shell - processo...

CVE-2023-40037

CVE-2023-40037: Validación incompleta de las URL de conexión JDBC y JNDI en Apache NiFi Apache NiFi 1.21.0 hasta 1.23.0 admiten acceso JDBC y JNDI JMS en varios Processors y Controller Services con una validación de URL de conexión que no proporciona protección suficiente contra entradas...

CVE-2023-34468

CVE-2023-34468: 通过 Apache NiFi 中的数据库组件远程执行代码 Apache NiFi 0.0.2 至 1.21.0 版本中的 DBCPConnectionPool 和 HikariCPConnectionPool 控制器服务允许经过身份验证和授权的用户配置使用 H2 驱动程序的数据库 URL，从而能够执行自定义代码。 供应商披露: 该漏洞的供应商披露和修复措施可在此处找到。 要求: 此漏洞需要: 有效的用户凭据 概念验证: 更多详细信息及利用过程可参阅此 PDF。 其他资源: 感谢 h00die 编写了 Metasploit 模块 并将我列为发现者。 Davi...

CVE-2023-34212

CVE-2023-34212: Apache NiFi中通过JNDI组件的Java反序列化 在Apache NiFi 1.8.0至1.21.0版本中，JndiJmsConnectionFactoryProvider控制器服务以及ConsumeJMS和PublishJMS处理器允许经过身份验证和授权的用户配置URL和库属性，从而能够从远程位置反序列化不可信数据。 厂商披露： 该漏洞的厂商披露和修复可以在此处找到。 要求： 此漏洞需要： 有效的用户凭据 概念验证： 更多详情和利用过程可在此PDF中找到。 附加资源： 感谢奇安信TI中心的Veraxy00 与我同时发现并报告了该漏洞。...

CVE-2024-56512-Apache-NiFi-Exploit

NiFiExploit 一个用于利用 Apache NiFi 中 CVE-2024-56512 漏洞的工具，该漏洞允许通过未正确保护的 API 未经授权访问敏感数据。...

nifi-CVE-2026-39816-poc

Apache NiFi CVE-2026-39816 POC Proof-of-concept demonstration for CVE-2026-39816, an EXECUTECODE permission bypass in Apache NiFi 2.8.0 that lets a flow designer who has been deliberately denied code-execution privileges run arbitrary Groovy in the NiFi JVM via the graph bundle's ExecuteGraphQuer...

apache__nifi_CVE-2022-33140_1-16-22

Apache NiFi 状态 资源 联系方式 !Track Issueshttps://img.shields.io/bad...

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

asf__nifi_CVE-2023-36542_1-22-0

Apache NiFi स्थिति संसाधन संपर्क !Track Issueshttps://img.shie...

asf__nifi_CVE-2023-34468_1-21-00

O Apache NiFi é um sistema fácil de usar, poderoso e confiável para processar e distribuir dados. Sumário Recursos Requisitos Primeiros Passos Subprojeto MiNiFi Subprojeto Registry Obtendo Ajuda Documentação...

CVE-2023-34468

CVE-2023-34468 Exploit Übersicht Dieses Repository stellt ein Python-basiertes Exploit-Tool für CVE-2023-34468 bereit, eine kritische Schwachstelle zur Remote-Code-Ausführung CVSS 9.8 in Apache NiFi Versionen 0.0.2 bis 1.21.0. Es ermöglicht authentifizierten Benutzern, beliebigen Code auszuführen...

CVE-2023-34468-PoC

PoC CVE-2023-34468 per Apache NiFi Proof-of-concept PoC didattico per CVE-2023-34468 che riguarda Apache NiFi versioni precedenti alla 1.22.0. Questo repository dimostra come l'abuso della configurazione degli URL JDBC di H2 possa portare a esecuzione remota di codice RCE autenticata nelle...

CVE-2023-34468-POC

CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Esecuzione remota di codice tramite istruzione RUNSCRIPT del database H2 in Apache NiFi = 1.21.0 Vulnerabilità Apache NiFi include di default un JAR del database H2. Il controller service DBCPConnectionPool può essere configurato per utilizzare questo...

GHSA-GGG2-9786-HWC8 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, apache-nifi-registry...

CVE-2026-73508 vulnerabilities

Vulnerabilities for packages: apicurio-registry, management-api-for-apache-cassandra-5.0, keycloak, thingsboard, strimzi-kafka-operator, zipkin, druid, opensearch, spark, akhq, apache-nifi, apache-pulsar, tez, celeborn...

CVE-2026-41706 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, geoserver...

GHSA-X2R2-RVHQ-2MQV vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, geoserver...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68981

The CVE-2026-68981 issue affects Apache NiFi versions 1.5.0 through 2.10.0, where gzip-encoded HTTP requests to the REST API are processed via a Jersey encoding filter. A configurable maximum is enforced on the compressed payload rather than the decompressed output, which could allow a malicious ...

CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...