asf__nifi_CVE-2023-34468_1-21-00

Apache NiFi 是一个易于使用、功能强大且可靠的数据处理和分发系统。 目录 功能特性 环境要求 快速入门 MiNiFi 子项目 Registry 子项目 获取帮助 文档 许可证 出口管制 功能特性 Apache NiFi 专为数据流而设计。它支持高度可配置的有向图，用于数据路由、转换和系统中介逻辑。其一些关键特性包括： 基于 Web 的用户界面 无缝的设计、控制和监控体验 多租户用户体验 高度可配置 容忍丢失 vs 保证交付 低延迟 vs 高吞吐量 动态优先级 运行时修改数据流 背压机制 向上扩展以充分利用机器能力 通过无主节点集群模型向下扩展 数据来源 从头到尾追踪数据流...

Apache NiFi 1.21.0 Remote Code Execution

Apache NiFi version 1.21.0 proof of concept remote code execution exploit that takes advantage of a flaw discovered in 2023. ============================================================================================================================================= | Title : Apache NiFi 1.21.0 R...

Apache NiFi 1.17.0 Remote Code Execution

Apache NiFi version 1.17.0 proof of concept remote code execution exploit that takes advantage of a flaw discovered in 2023. ============================================================================================================================================= | Title : Apache NiFi 1.17.0 R...

CVE-2023-34468

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC...

Metasploit Weekly Wrap-Up

Pumpkin Spice Modules Here in the northern hemisphere, fall is on the way: leaves changing, the air growing crisp and cool, and some hackers changing the flavor of their caffeine. This release features a new exploit module targeting Apache NiFi as well as a new and improved library to interact wi...

CVE-2023-34468

creationtimestamp| type| source ---|---|--- 2023-08-30 13:14:24+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apachenifih2rce.rb 2023-09-29 16:07:50+00:00| exploited| https://t.me/informationsecuritychannel/50739 2023-11-10 21:18:42+00:00| see...

Apache NiFi H2 Connection String Remote Code Execution Exploit

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. This exploit will result in several shells 5-7. Successfully test...

Apache NiFi H2 Connection String Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache NiFi H2 Connection String Remote Code Execution', 'Description' = %q The DBCPConnectionPool and HikariCPConnectionPool Controller Services...

CVE-2023-34468

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC...

CVE-2023-34468

CVE-2023-34468 affects Apache NiFi controllers: DBCPConnectionPool and HikariCPConnectionPool. Versions 0.0.2 through 1.21.0 allow an authenticated/authorized user to configure a Database URL using the H2 driver that enables custom code execution. The issue is mitigated by upgrading to NiFi 1.22....

CVE-2023-34468 Apache NiFi: Potential Code Injection with Database Services using H2

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC...