Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

CVE-2023-34468-POC

CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Remote Code Execution via H2 Database RUNSCRIPT in Apache NiFi = 1.21.0 Vulnerability Apache NiFi ships with an H2 database JAR bundled by default. The DBCPConnectionPool controller service can be configured to use this H2 driver. H2 supports a RUNSCRIP...

My-Exploits

My-Exploits Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of...

CVE-2023-34468

CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC Short Python PoC for abusing an editable Apache NiFi ExecuteSQL processor with an H2 RUNSCRIPT payload to trigger remote command execution through a Bash reverse shell. For authorized testing and research only. Do not use against system...

CVE-2023-34468-PoC

CVE-2023-34468 PoC for Apache NiFi Educational proof-of-concept PoC for CVE-2023-34468 affecting Apache NiFi versions prior to 1.22.0. This repository demonstrates how abuse of H2 JDBC URL configuration can lead to authenticated remote code execution RCE in vulnerable Apache NiFi installations...

CVE-2024-56512-Apache-NiFi-Exploit

NiFiExploit A tool to exploit the CVE-2024-56512 vulnerability in Apache NiFi , which allows unauthorized access to sensitive data through improperly secured APIs...

CVE-2023-34468

CVE-2023-34468: Remote Code Execution via DB Components in Apache NiFi The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code...

asf__nifi_CVE-2023-34468_1-21-00

nifi Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data. Table of Contents Features Requirements Getting Started MiNiFi subproject Registry subproject Getting Help Documentation License Export Control Features Apache NiFi was made for dataflow. It supports...

CVE-2023-34212

CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properti...

CLEANSTART-2026-KE05619 Security fix for GHSA-v468-qcjx-r72w applied in: apache-nifi 2.9.0-r2

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-UH54253 Security fix for GHSA-337m-mw94-2v6g applied in: apache-nifi 2.9.0-r2

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-YR29946 Security fix for GHSA-hvcg-qmg6-jm4c applied in: apache-nifi 2.9.0-r2

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GU96654 Security fix for GHSA-38f8-5428-x5cv applied in: apache-nifi 2.9.0-r2

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EV76601 Security fix for GHSA-m4cv-j2px-7723 applied in: apache-nifi 2.9.0-r2

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-MR43504 Security fix for GHSA-v8h7-rr48-vmmv applied in: apache-nifi 2.9.0-r2

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-IU54298 Security fix for GHSA-xxqh-mfjm-7mv9 applied in: apache-nifi 2.9.0-r2

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LV51660 Security fix for GHSA-57rv-r2g8-2cj3 applied in: apache-nifi 2.9.0-r2

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-WG35176 Security fix for GHSA-f6hv-jmp6-3vwv applied in: apache-nifi 2.9.0-r2

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-IS69822 Security fix for GHSA-mj4r-2hfc-f8p6 applied in: apache-nifi 2.9.0-r2

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-CN73309 Security fix for GHSA-cm33-6792-r9fm applied in: apache-nifi 2.9.0-r2

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...