CVE-2021-33191

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

Command injection

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

CVE-2021-33191

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

CVE-2021-33191 MiNiFi CPP arbitrary script execution is possible on the agent's host machine through the c2 protocol

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

PT-2021-20073

Name of the Vulnerable Software and Affected Versions Apache NiFi MiNiFi C++ versions 0.5.0 through 0.9.x Description The c2 protocol in Apache NiFi MiNiFi C++ implements an "agent-update" command designed to patch the application binary. This command defaults to calling a trusted binary but can ...

CVE-2021-33191: Improper Neutralization of Special Elements used in an OS Command

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

Apache NiFi 操作系统命令注入漏洞

Apache NiFi is a data processing and distribution system from the Apache Foundation in the United States. The system is primarily used for data routing, transformation, and system mediation logic. versions prior to Apache NiFi MiNiFi C version 0.5.0 have security vulnerabilities that allow an...

org.apache.nifi:nifi-hbase_1_1_2-client-service (>=1.9.0, <=1.14.0), org.apache.nifi:nifi-hbase_1_1_2-client-service-nar (>=1.9.0, <=1.14.0) +11 more potentially affected by CVE-2021-21409 via io.netty:netty (3.6.9.final)

io.netty:netty MAVEN version 3.6.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - org.apache.nifi:nifi-hbase112-client-service =1.9.0, =1.9.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =2.3.22.final, =2.3.22.final,...

org.apache.nifi:nifi-hbase_1_1_2-client-service (>=1.9.0, <=1.14.0), org.apache.nifi:nifi-hbase_1_1_2-client-service-nar (>=1.9.0, <=1.14.0) +11 more potentially affected by CVE-2021-21295 +1 more via io.netty:netty (3.6.9.final)

io.netty:netty MAVEN version 3.6.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - org.apache.nifi:nifi-hbase112-client-service =1.9.0, =1.9.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =2.3.22.final, =2.3.22.final,...

Unencrypted passwords

A vulnerability found in Apache NIFI before v0.4.0-RC2. Passwords of InvokeHTTP weren?t encrypted...

GHSA-Q594-2475-8V9F Unencrypted passwords

A vulnerability found in Apache NIFI before v0.4.0-RC2. Passwords of InvokeHTTP weren?t encrypted...

PT-2021-24449

Name of the Vulnerable Software and Affected Versions: Apache NIFI versions prior to 0.4.0-RC2 Description: A security issue was discovered in Apache NIFI where passwords for the InvokeHTTP component were not encrypted. Recommendations: For versions prior to 0.4.0-RC2, update to version 0.4.0-RC2...

GHSA-288C-CQ4H-88GQ vulnerabilities

Vulnerabilities for packages: apache-nifi...

GHSA-288C-CQ4H-88GQ vulnerabilities

Vulnerabilities for packages: hive...

CVE-2020-25649 vulnerabilities

Vulnerabilities for packages: hive...

CVE-2020-25649 vulnerabilities

Vulnerabilities for packages: apache-nifi...

Apache NiFi API Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Potential Improvements: Add option to authenticate using client certificate Add a scanner module? class MetasploitModule 'Apache NiFi API Remote Code Execution',...

Metasploit Wrap-Up

Exploiting weak configurations Community contributor Graeme Robinson added two modules targeting insecurely configured API's, both of which lead to remote code execution. The first module exploits a lack of access control in Apache NiFi, which allows for the creation of an ExecuteProcess processo...

Apache NiFi API Remote Code Execution

This module uses the NiFi API to create an ExecuteProcess processor that will execute OS commands. The API must be unsecured or credentials provided and the ExecuteProcess processor must be available. An ExecuteProcessor processor is created then is configured with the payload and started. The...

CVE-2020-9487

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token one-time password mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens,...