CVE-2022-29265: Apache NiFi XML External Entity Reference Restriction Bypass

org.apache.nifi:nifi Updated 02 Oct 2025

Summary

01/05/2022

Disclosed on

CVE-2022-29265

CVE

Yes i

Fix available

High

Severity

7.5

CVSS Score

CVE-2022-29265: Multiple components in Apache NiFi do not restrict XML External Entity references. Affects org.apache.nifi:nifi versions >= 0.0.1, < 1.16.1. Fixed in 1.16.1. How to fix ↓

Also tracked for

nifi · Bitnami

The same CVE-2022-29265 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache NiFi is an open-source system designed for processing and distributing data. It offers various components and processors to facilitate data flow. However, versions 0.0.1 to 1.16.0 of Apache NiFi suffer from a vulnerability that allows XML External Entity (XXE) references in the default configuration. This vulnerability affects multiple components, including the Standard Content Viewer service, EvaluateXPath, EvaluateXQuery, and ValidateXml processors. By default, these components attempt to resolve XXE references, which can be exploited by malicious XML documents containing Document Type Declarations with XXE references. The vulnerability has been addressed in NiFi version 1.16.1, which disables Document Type Declarations and disallows XXE resolution in standard services.

Vulnerability Detail

The vulnerability in Apache NiFi allows for the bypassing of XML External Entity (XXE) reference restrictions. This can be exploited by crafting malicious XML documents that contain Document Type Declarations with XXE references. When processed by vulnerable components such as the Standard Content Viewer service, EvaluateXPath, EvaluateXQuery, or ValidateXml processors, these documents can trigger the resolution of XXE references. This can lead to various security risks, including information disclosure, server-side request forgery (SSRF), and denial of service (DoS) attacks. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.

How To Fix

Minimum fixed version

1.16.1

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a workaround, users can manually modify the configuration of the vulnerable components to disable the resolution of XXE references. This can be achieved by adjusting the property values of the Standard Content Viewer service, EvaluateXPath, EvaluateXQuery, and ValidateXml processors to disallow XXE resolution. Here is an example of how to disable XXE resolution in the EvaluateXPath processor:

Open the NiFi user interface.
Locate the EvaluateXPath processor in your flow configuration.
Click on the processor to open its settings.
In the properties tab, find the property related to XXE resolution (e.g., 'Enable XXE Resolution').
Set the value of the property to 'false' to disable XXE resolution.
Save the changes and restart the NiFi service.

Repeat the same steps for other vulnerable components as necessary.

Conclusion

The vulnerability in Apache NiFi that allows for XML External Entity (XXE) reference bypass has been addressed in version 1.16.1. Users are advised to upgrade their installations to this version or later to mitigate the risk. Additionally, a workaround is available for users who cannot immediately upgrade, allowing them to manually disable XXE resolution in the affected components. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.apache.nifi:nifi →