CVE-2022-26850: Apache NiFi Insufficiently Protected Credentials Vulnerability
Summary
CVE-2022-26850: Insufficiently protected credentials. Affects nifi versions >= 1.14.0, < 1.16.0. Fixed in 1.16.0. How to fix ↓
Also tracked for
The same CVE-2022-26850 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration tool that automates the flow of data between systems. It provides a user-friendly interface for designing data flows and supports various data sources and destinations. The tool is widely used for data ingestion, transformation, and routing. However, it has a vulnerability related to the handling of credentials for single-user access, which could expose sensitive information.
Vulnerability Detail
The vulnerability arises when Apache NiFi creates or updates credentials for single-user access. During this process, it writes a copy of the Login Identity Providers configuration to the operating system's temporary directory, which typically has global read permissions. Although NiFi quickly moves this temporary file to the final configuration directory, the brief window of opportunity for unauthorized access poses a security risk. This vulnerability can lead to exposure of sensitive credentials, potentially allowing unauthorized users to gain access to the system.
How To Fix
Minimum fixed version
1.16.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the operating system's temporary directory to prevent unauthorized users from reading files during the brief window when the configuration is written. This can be done by adjusting the permissions of the temporary directory, although it is not a complete solution and updating to the patched version is strongly recommended.
Conclusion
In summary, CVE-2022-26850 is a medium-severity vulnerability in Apache NiFi that can expose sensitive credentials due to insufficient protection during the credential management process. It is crucial to update to version 1.16.0 or later to mitigate this risk. Users are also encouraged to utilize tools like Vulert to monitor and manage vulnerabilities in their applications.
See every vulnerability recorded for nifi →
FAQ
CVE-2022-26850 is a vulnerability in Apache NiFi that involves insufficient protection of credentials during the creation or update process, potentially exposing sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Apache NiFi versions prior to 1.16.0 are affected by this vulnerability.
If an immediate update is not possible, consider restricting access to the temporary directory as a temporary workaround until you can upgrade.
More information can be found in the official vulnerability database at https://github.com/bitnami/vulndb/tree/main/data/nifi/BIT-nifi-2022-26850.json.
Related vulnerabilities
Recent vulnerabilities recorded for nifi.
