CVE-2023-40037: Apache NiFi Insufficient Property Validation vulnerability
Summary
CVE-2023-40037: Apache NiFi Insufficient Property Validation vulnerability. Affects org.apache.nifi:nifi-dbcp-base versions >= 1.21.0, < 1.23.1. Fixed in 1.23.1. How to fix ↓
Also tracked for
- nifi · Bitnami
The same CVE-2023-40037 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration tool that enables the automation of data flow between different systems. It provides a web-based interface for designing, managing, and monitoring data flows. The nifi-dbcp-base, nifi-jms-processors, nifi-dbcp-service-api, and nifi-dbcp-service-bundle packages are part of Apache NiFi and are used for JDBC and JNDI JMS access in several Processors and Controller Services.
Vulnerability Detail
The Apache NiFi versions 1.21.0 through 1.23.0 suffer from an Insufficient Property Validation vulnerability. This vulnerability arises from the lack of sufficient protection against crafted inputs in the connection URL validation of JDBC and JNDI JMS access. An authenticated and authorized user can bypass connection URL validation using custom input formatting. This could lead to unauthorized access, data leakage, or other security breaches. The vulnerability has been assigned the CVE identifier CVE-2023-40037.
How To Fix
Minimum fixed version
1.23.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache NiFi.
Conclusion
The Insufficient Property Validation vulnerability in Apache NiFi versions 1.21.0 through 1.23.0 can be mitigated by upgrading to version 1.23.1. It is important to promptly apply the recommended fix to ensure the security and integrity of data flows in Apache NiFi. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi-dbcp-base →
FAQ
Apache NiFi is an open-source data integration tool that provides a web-based interface for designing, managing, and monitoring data flows between different systems.
The vulnerability allows an authenticated and authorized user to bypass connection URL validation, potentially leading to unauthorized access, data leakage, or other security breaches.
To fix this vulnerability, it is recommended to upgrade to Apache NiFi version 1.23.1, which includes enhancements to connection URL validation and introduces validation for additional related properties.
There is no specific workaround provided for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache NiFi.
You can find more information about this vulnerability in the Apache NiFi advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-23qf-3jf9-h3q9/GHSA-23qf-3jf9-h3q9.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi-dbcp-base.
