CVE-2023-34468: Apache NiFi Code Injection Vulnerability
Summary
CVE-2023-34468: Apache NiFi vulnerable to Code Injection. Affects org.apache.nifi:nifi-dbcp-base versions >= 0.0.2, < 1.22.0. Fixed in 1.22.0. How to fix ↓
Also tracked for
- nifi · Bitnami
The same CVE-2023-34468 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration and workflow automation tool that enables the automation of data flow between different systems. It provides a web-based interface for designing, managing, and monitoring data flows. The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi versions 0.0.2 through 1.21.0 are affected by a code injection vulnerability. These services allow authenticated and authorized users to configure a Database URL with the H2 driver, which can lead to custom code execution.
Vulnerability Detail
The code injection vulnerability in Apache NiFi allows an attacker to execute arbitrary code by manipulating the Database URL with the H2 driver. This can result in unauthorized access, data leakage, or even complete compromise of the affected system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.22.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of code injection.
Conclusion
The code injection vulnerability in Apache NiFi poses a significant risk to the security of the affected systems. It is crucial to upgrade to the fixed version (1.22.0 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi-dbcp-base →
FAQ
Apache NiFi is an open-source data integration and workflow automation tool used for designing, managing, and monitoring data flows between different systems.
This vulnerability allows an attacker to execute arbitrary code, potentially leading to unauthorized access, data leakage, or complete compromise of the affected system.
To fix this vulnerability, upgrade to Apache NiFi version 1.22.0 or later, which includes a resolution for the code injection issue.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi-dbcp-base.
