CVE-2018-17193: Apache NiFi Reflected XSS Vulnerability
Summary
CVE-2018-17193: Cross site scripting in org.apache.nifi:nifi. Affects org.apache.nifi:nifi versions >= 1.0.0, < 1.8.0. Fixed in 1.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration and data flow automation tool. It provides a web-based user interface for designing, managing, and monitoring data flows. The vulnerability in question affects versions of Apache NiFi prior to 1.8.0. This vulnerability allows for a reflected cross-site scripting (XSS) attack, where an attacker can inject malicious scripts into the application, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The vulnerability arises from the improper handling of the X-ProxyContextPath HTTP request header in the message-page.jsp error page of Apache NiFi. The value of this header is not properly sanitized, allowing an attacker to inject malicious scripts that will be executed in the context of the victim's browser. This can lead to various security issues, such as session hijacking, defacement of the application, or theft of sensitive information. The vulnerability has a CVSS score of 6.1, indicating a moderate severity.
How To Fix
Minimum fixed version
1.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can consider implementing additional security measures, such as input validation and output encoding, to mitigate the risk of XSS attacks in general.
Conclusion
The Apache NiFi Reflected XSS Vulnerability (CVE-2018-17193) is a moderate severity vulnerability that affects versions of Apache NiFi prior to 1.8.0. It allows for a reflected XSS attack, potentially leading to unauthorized access, data theft, or other malicious activities. Users of Apache NiFi should upgrade to version 1.8.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi →
FAQ
Apache NiFi is an open-source data integration and data flow automation tool. It provides a web-based user interface for designing, managing, and monitoring data flows.
A reflected cross-site scripting (XSS) attack is a type of security vulnerability where an attacker injects malicious scripts into a website or web application, which are then executed in the context of the victim's browser.
This vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity.
To fix this vulnerability, users of Apache NiFi should upgrade to version 1.8.0 or later, which includes a fix for the XSS vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi.
