CVE-2023-40037GHSA-23QF-3JF9-H3Q9BIT-NIFI-2023-40037
Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.23.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Apache Software Foundation Apache NiFi
From 1.21.0 · through 1.23.0
- org.apache.nifi:nifi-dbcp-baseMaven
From 1.21.0 · fixed in 1.23.1
- org.apache.nifi:nifi-jms-processorsMaven
From 1.21.0 · fixed in 1.23.1
- org.apache.nifi:nifi-dbcp-service-apiMaven
From 1.21.0 · fixed in 1.23.1
- org.apache.nifi:nifi-dbcp-service-bundleMaven
From 1.21.0 · fixed in 1.23.1