CVE-2022-33140: The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution…

PriorityP261high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

3.67%

88.4th percentile

The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellUserGroupProvider to be one of the enabled User Group Providers in the Authorizers configuration. Command injection also requires an authenticated user with elevated privileges. Apache NiFi requires an authenticated user with authorization to modify access policies in order to execute the command. Apache NiFi Registry requires an authenticated user with authorization to read user groups in order to execute the command. The resolution removes command formatting based on user-provided arguments.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
apache	nifi	—	—
apache	nifi	1.10.0 – 1.16.2	—
apache	nifi_registry	0.6.0 – 1.16.2	—
apache_software_foundation	apache_nifi	>= 1.10.0 < 1.10.0*	1.10.0*
apache_software_foundation	apache_nifi	up to 1.16.2 – 1.16.2	—
apache_software_foundation	apache_nifi_registry	>= 0.6.0 < 0.6.0*	0.6.0*
apache_software_foundation	apache_nifi_registry	up to 1.16.2 – 1.16.2	—

Detection & IOCsextracted from sources · hover to see the quote

→Command injection is only possible when ShellUserGroupProvider is explicitly enabled as one of the User Group Providers in the Authorizers configuration — audit conf/authorizers.xml for presence of ShellUserGroupProvider ↗
→Exploitation requires an authenticated user with authorization to modify access policies (NiFi) or read user groups (NiFi Registry) — monitor for privilege escalation or unexpected policy/group-read activity by non-admin accounts ↗
→Injection targets OS-level group resolution commands on Linux and macOS; monitor NiFi process for unexpected child process spawning (e.g., /bin/sh, id, whoami, curl) originating from the NiFi JVM ↗
→Affected versions are Apache NiFi 1.10.0–1.16.2 and Apache NiFi Registry 0.6.0–1.16.2; flag any deployment running these version ranges with ShellUserGroupProvider enabled ↗
→The fix in 1.16.3 completely removed shell commands from ShellUserGroupProvider that received user arguments — absence of this fix (i.e., version < 1.16.3) combined with ShellUserGroupProvider in use is a high-confidence vulnerable indicator ↗

·ShellUserGroupProvider is NOT in the default configuration; exploitation is only possible if it has been explicitly enabled — the attack surface is limited to non-default deployments ↗
·Exploitation additionally requires an already-authenticated user with elevated privileges, meaning unauthenticated or low-privilege users cannot trigger the injection ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

vendor_apache8.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.