CVE-2019-12421: Apache NiFi user log out issue
Summary
CVE-2019-12421: Apache NiFi user log out issue. Affects org.apache.nifi:nifi-web-security versions >= 1.3.0, < 1.10.0. Fixed in 1.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration tool that allows users to automate the flow of data between different systems. It provides a web-based interface for designing and managing data flows. NiFi supports various authentication mechanisms, including PKI. However, versions 1.0.0 to 1.9.2 of NiFi have a vulnerability that affects user log out functionality.
Vulnerability Detail
When using an authentication mechanism other than PKI, NiFi versions 1.0.0 to 1.9.2 do not properly invalidate the authentication token on the server side when a user clicks Log Out. Although the client-side token is invalidated, the server-side token remains valid for up to 12 hours. This allows an attacker to use the user's token to make API requests to NiFi, potentially gaining unauthorized access to sensitive data or performing malicious actions.
How To Fix
Minimum fixed version
1.10.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a workaround is to manually invalidate the authentication token on the server side after the user logs out. This can be done by modifying the NiFi source code or by implementing a custom solution that ensures the server-side token is invalidated when the user logs out.
Conclusion
The Apache NiFi user log out issue (CVE-2019-12421) affects versions 1.0.0 to 1.9.2 of NiFi. It allows an attacker to use a user's authentication token to make unauthorized API requests. To fix this vulnerability, it is recommended to upgrade to NiFi version 1.10.0 or later. If upgrading is not immediately possible, a workaround is available to manually invalidate the authentication token on the server side. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi-web-security →
FAQ
Apache NiFi is an open-source data integration tool that allows users to automate the flow of data between different systems. It provides a web-based interface for designing and managing data flows.
NiFi versions 1.0.0 to 1.9.2 are affected by this vulnerability.
This vulnerability allows an attacker to use a user's authentication token to make API requests to NiFi, potentially gaining unauthorized access to sensitive data or performing malicious actions.
To fix this vulnerability, it is recommended to upgrade to NiFi version 1.10.0 or later.
If upgrading to the latest version is not immediately possible, a workaround is to manually invalidate the authentication token on the server side after the user logs out.
