CVE-2017-15697: Apache NiFi XSS issue in context path handling
Summary
CVE-2017-15697: Apache NiFi XSS issue in context path handling. Affects org.apache.nifi:nifi versions >= 1.0.0, < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration tool that enables the automation of data flow between different systems. It provides a web-based user interface for designing and managing data flows. The vulnerability identified as CVE-2017-15697 affects Apache NiFi versions prior to 1.5.0. This vulnerability allows an attacker to execute remote code by exploiting a cross-site scripting (XSS) issue in the handling of the X-ProxyContextPath or X-Forwarded-Context headers. By injecting malicious external resources or embedded code into these headers, an attacker can potentially execute arbitrary code on the affected system.
Vulnerability Detail
The vulnerability arises from a lack of proper handling of the X-ProxyContextPath or X-Forwarded-Context headers in Apache NiFi. These headers are used to specify the context path of the application when it is running behind a reverse proxy. However, if these headers are not properly validated and sanitized, an attacker can manipulate them to inject malicious code or external resources. This can lead to remote code execution, compromising the security and integrity of the system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 2.12.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache NiFi.
Conclusion
The Apache NiFi vulnerability identified as CVE-2017-15697 is a critical issue that allows remote code execution through cross-site scripting (XSS) in the handling of certain headers. Users of Apache NiFi versions prior to 1.5.0 are advised to upgrade to the appropriate release to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi →
FAQ
Apache NiFi is an open-source data integration tool that enables the automation of data flow between different systems. It provides a web-based user interface for designing and managing data flows.
This vulnerability allows an attacker to execute remote code by exploiting a cross-site scripting (XSS) issue in the handling of the X-ProxyContextPath or X-Forwarded-Context headers. By injecting malicious external resources or embedded code into these headers, an attacker can potentially execute arbitrary code on the affected system.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
To fix this vulnerability, users running Apache NiFi versions prior to 1.5.0 should upgrade to the appropriate release. The fix for this issue was applied in the Apache NiFi 1.5.0 release.
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache NiFi.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi.
