CVE-2018-17195: Cleartext Transmission of Sensitive Information in Apache NiFi
Summary
CVE-2018-17195: Cleartext Transmission of Sensitive Information in Apache nifi. Affects org.apache.nifi:nifi versions >= 1.0.0, < 1.8.0. Fixed in 1.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration tool that provides a web-based interface to design, control, and manage the flow of data between different systems. It is built on top of the Java Virtual Machine (JVM) and offers a wide range of processors, controllers, and services for data routing, transformation, and mediation. However, a vulnerability in Apache NiFi versions prior to 1.8.0 allows for cleartext transmission of sensitive information, potentially leading to a CSRF attack.
Vulnerability Detail
The vulnerability arises from the template upload API endpoint in Apache NiFi, which accepts requests from different domains when used in conjunction with an ARP spoofing and man-in-the-middle (MiTM) attack. This allows for a complex attack vector involving client certificate authentication, same subnet access, and injection of malicious code into an unprotected website visited by the targeted user. The severity of the vulnerability is rated as High, as it can result in a CSRF attack and potential damage to the system. The vulnerability was fixed in the Apache NiFi 1.8.0 release by applying Cross-Origin Resource Sharing (CORS) policy request filtering.
How To Fix
Minimum fixed version
1.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Apache NiFi, CVE-2018-17195, allows for cleartext transmission of sensitive information and can lead to a CSRF attack. It is crucial for users to upgrade their Apache NiFi installation to version 1.8.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi →
FAQ
Apache NiFi is an open-source data integration tool that provides a web-based interface for designing, controlling, and managing the flow of data between different systems.
CSRF (Cross-Site Request Forgery) is an attack that tricks the victim into submitting a malicious request. In the context of this vulnerability, it can be used to exploit the cleartext transmission of sensitive information in Apache NiFi.
The vulnerability occurs due to the acceptance of requests from different domains in the template upload API endpoint, when used in conjunction with an ARP spoofing and man-in-the-middle (MiTM) attack.
The severity level of this vulnerability is rated as High, as it can result in a CSRF attack and potential damage to the system.
To mitigate this vulnerability, users should upgrade their Apache NiFi installation to version 1.8.0 or later, which includes the fix for the Cross-Origin Resource Sharing (CORS) policy request filtering.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi.
