CVE-2020-9487: Apache NiFi Download Token Vulnerability Leading to Denial of Service
Summary
CVE-2020-9487: In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access... Affects nifi versions >= 1.0.0, <= 1.11.4. No fix is published. How to fix ↓
Also tracked for
- org.apache.nifi:nifi · Maven
The same CVE-2020-9487 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache NiFi is a powerful data integration tool designed to automate the flow of data between systems. It provides a user-friendly interface for managing data flows and supports various data formats and protocols. However, versions 1.0.0 to 1.11.4 of NiFi are susceptible to a vulnerability that affects its download token mechanism, potentially allowing unauthorized users to disrupt legitimate access.
Vulnerability Detail
In Apache NiFi versions 1.0.0 to 1.11.4, the download token mechanism utilized a fixed cache size and lacked proper authentication when creating download tokens. This flaw enables unauthenticated users to repeatedly request download tokens, which can lead to denial of service for legitimate users who are unable to obtain tokens for accessing content. The vulnerability is critical as it can severely impact the availability of the service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on the token request endpoint to mitigate the impact of repeated unauthorized requests. This can help ensure that legitimate users can still access download tokens while a permanent fix is being applied.
Conclusion
CVE-2020-9487 is a significant vulnerability in Apache NiFi that can lead to denial of service for legitimate users. It is crucial to update to the patched version to ensure the security and availability of your data flows. Implementing temporary workarounds can help mitigate the impact until the update is applied.
See every vulnerability recorded for nifi →
FAQ
CVE-2020-9487 is a vulnerability in Apache NiFi that allows unauthenticated users to request download tokens repeatedly, potentially leading to denial of service for legitimate users.
The vulnerability affects Apache NiFi versions from 1.0.0 to 1.11.4.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The main consequence is a denial of service, where legitimate users are unable to obtain download tokens due to excessive requests from unauthorized users.
Yes, a patch is available in Apache NiFi version 1.11.5 and later. It is recommended to update to this version to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for nifi.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
