CVE-2023-34468

CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC Short Python PoC for abusing an editable Apache NiFi ExecuteSQL processor with an H2 RUNSCRIPT payload to trigger remote command execution through a Bash reverse shell. For authorized testing and research only. Do not use against system...

CVE-2023-34468-PoC

CVE-2023-34468 PoC for Apache NiFi Educational proof-of-concept PoC for CVE-2023-34468 affecting Apache NiFi versions prior to 1.22.0. This repository demonstrates how abuse of H2 JDBC URL configuration can lead to authenticated remote code execution RCE in vulnerable Apache NiFi installations...

asf__nifi_CVE-2023-36542_1-22-0

Apache NiFi Status Resources Contacts !Track Issueshttps://img...

asf__nifi_CVE-2023-34468_1-21-00

Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data. Table of Contents Features Requirements Getting Started MiNiFi subproject Registry subproject Getting Help...

apache__nifi_CVE-2022-33140_1-16-22

Apache NiFi Status Resources Contacts !Track Issueshttps://img...

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

CVE-2024-56512-Apache-NiFi-Exploit

NiFiExploit أداة لاستغلال ثغرة CVE-2024-56512 في Apache NiFi ، والتي تسمح بالوصول غير المصرح به إلى البيانات الحساسة عبر واجهات برمجة تطبيقات غير مؤمّنة بشكل صحيح...

nifi-CVE-2026-39816-poc

Apache NiFi CVE-2026-39816 POC إثبات مفهوم لـ CVE-2026-39816، وهو تجاوز لصلاحية EXECUTECODE في Apache NiFi 2.8.0 يسمح لمصمم التدفق الذي تم حرمانه عمدًا من صلاحيات تنفيذ التعليمات البرمجية بتشغيل أكواد Groovy عشوائية في JVM الخاص بـ NiFi عبر معالج ExecuteGraphQuery من حزمة الرسم البياني. تم الإصلا...

CVE-2023-34468

CVE-2023-34468 Exploit Overview This repository provides a Python-based exploit tool for CVE-2023-34468 , a critical remote code execution vulnerability CVSS 9.8 in Apache NiFi versions 0.0.2 through 1.21.0. It allows authenticated users to execute arbitrary code by manipulating H2 database...

CVE-2023-34212

CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properti...

CVE-2023-40037

CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs...

CVE-2023-34468

CVE-2023-34468: Remote Code Execution via DB Components in Apache NiFi The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code...

My-Exploits

My-Exploits بحث في الثغرات الأمنية أجريته على أربع خدمات منصات منتشرة على نطاق واسع: Keycloak، Apache NiFi، HashiCorp Vault وHashiCorp Nomad. لكل اكتشاف، يحمل هذا المستودع القطع الأثرية المكتوبة مرة واحدة التي أستخدمها فعليًا، ووحدة Metasploit حيثما كان ذلك منطقيًا، وإثبات مفهوم مستقل بلغة Python...

CVE-2023-34468-POC

CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Remote Code Execution via H2 Database RUNSCRIPT in Apache NiFi = 1.21.0 Vulnerability Apache NiFi ships with an H2 database JAR bundled by default. The DBCPConnectionPool controller service can be configured to use this H2 driver. H2 supports a RUNSCRIP...

GHSA-GGG2-9786-HWC8 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe...

CVE-2026-73508 vulnerabilities

Vulnerabilities for packages: tez, apache-pulsar, spark, strimzi-kafka-operator, zipkin, celeborn, keycloak, opensearch, apicurio-registry, apache-nifi, thingsboard, akhq, druid, management-api-for-apache-cassandra-5.0...

CVE-2026-41706 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, geoserver...

GHSA-X2R2-RVHQ-2MQV vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, geoserver...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68981

The CVE-2026-68981 issue affects Apache NiFi versions 1.5.0 through 2.10.0, where gzip-encoded HTTP requests to the REST API are processed via a Jersey encoding filter. A configurable maximum is enforced on the compressed payload rather than the decompressed output, which could allow a malicious ...