CVE-2023-22832: XML External Entity Reference in Apache NiFi
Summary
CVE-2023-22832: XML External Entity Reference in Apache NiFi. Affects org.apache.nifi:nifi-ccda-processors versions >= 1.2.0, < 1.20.0. Fixed in 1.20.0. How to fix ↓
Also tracked for
- nifi · Bitnami
The same CVE-2023-22832 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration and workflow automation tool that enables the automation of data flow between different systems. It provides a web-based interface for designing, managing, and monitoring data flows. The ExtractCCDAAttributes Processor in Apache NiFi versions 1.2.0 through 1.19.1 is affected by a vulnerability that allows XML External Entity (XXE) references. This vulnerability can be exploited by malicious XML documents containing Document Type Declarations (DTDs) with XXE references. The ExtractCCDAAttributes Processor does not properly restrict these references, making flow configurations that include this processor vulnerable to attacks.
Vulnerability Detail
The vulnerability in Apache NiFi's ExtractCCDAAttributes Processor allows for XML External Entity (XXE) references. This means that malicious XML documents containing Document Type Declarations (DTDs) with XXE references can be processed by the ExtractCCDAAttributes Processor. As a result, an attacker can exploit this vulnerability to perform various attacks, such as reading arbitrary files on the server or initiating network connections to external systems. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.20.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Conclusion
The vulnerability in Apache NiFi's ExtractCCDAAttributes Processor allows for XML External Entity (XXE) references, which can be exploited by malicious XML documents. To mitigate this vulnerability, it is recommended to upgrade to Apache NiFi version 1.20.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi-ccda-processors →
FAQ
Apache NiFi is an open-source data integration and workflow automation tool.
The ExtractCCDAAttributes Processor is a component in Apache NiFi that is used for extracting attributes from CCDA (Consolidated Clinical Document Architecture) XML documents.
An XML External Entity (XXE) reference is a type of vulnerability that allows an attacker to include external entities in an XML document, potentially leading to information disclosure or remote code execution.
This vulnerability can be exploited by an attacker to read arbitrary files on the server or initiate network connections to external systems, potentially leading to unauthorized access or data leakage.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
