CVE-2017-12623: XML External Entity Reference in Apache NiFi
Summary
CVE-2017-12623: XML External Entity Reference in Apache NiFi. Affects org.apache.nifi:nifi versions >= 1.0.0, < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration and data flow automation tool. It provides a web-based user interface to design, control, and monitor the flow of data between different systems. The vulnerability identified as CVE-2017-12623 is related to XML External Entity (XXE) attacks. XXE attacks occur when an application processes XML input that contains external entity references, which can lead to unauthorized access to sensitive files and information.
Vulnerability Detail
The vulnerability in Apache NiFi allows an authorized user to upload a template containing malicious code that can exploit an XML External Entity (XXE) vulnerability. By exploiting this vulnerability, an attacker can access sensitive files and potentially perform unauthorized actions. The fix for this vulnerability was implemented in the Apache NiFi 1.4.0 release. Users running a prior 1.x release are advised to upgrade to the appropriate release to mitigate the risk.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache NiFi.
Conclusion
The vulnerability in Apache NiFi, identified as CVE-2017-12623, allows an authorized user to upload a template containing malicious code that can exploit an XML External Entity (XXE) vulnerability. To mitigate the risk, users are advised to upgrade to Apache NiFi version 1.4.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi →
FAQ
Apache NiFi is an open-source data integration and data flow automation tool that provides a web-based user interface for designing, controlling, and monitoring data flows between different systems.
An XML External Entity (XXE) attack is a type of vulnerability where an attacker can exploit the processing of XML input that contains external entity references. This can lead to unauthorized access to sensitive files and information.
This vulnerability can be exploited by an authorized user uploading a template containing malicious code that triggers an XML External Entity (XXE) attack. This allows the attacker to access sensitive files and potentially perform unauthorized actions.
Yes, the vulnerability has been fixed in the Apache NiFi 1.4.0 release. Users running a prior 1.x release are advised to upgrade to the appropriate release to mitigate the risk.
You can find more information about the vulnerability in the Apache NiFi advisory database. The specific advisory for this vulnerability can be found at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qj7f-j6h9-g5rq/GHSA-qj7f-j6h9-g5rq.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi.
