cbcvebase.
CVE-2023-34468
published 2023-06-12

CVE-2023-34468: The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to…

PriorityP278high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
63.63%
99.1th percentile
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Affected

3 ranges
VendorProductVersion rangeFixed in
apachenifi——
apachenifi>= 0.0.2 < 1.22.01.22.0
apache_software_foundationapache_nifi0.0.2 – 1.21.0—

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_nifi_h2_rce.rb↗
  • →Monitor NiFi DBCPConnectionPool and HikariCPConnectionPool Controller Service configurations for Database URLs containing the H2 JDBC driver string (e.g., 'jdbc:h2:'). ↗
  • →Alert on any NiFi API calls (authenticated) that set or update a Controller Service Database URL property containing H2 JDBC locations, as the fix specifically rejects these. ↗
  • →Exploitation produces multiple reverse shells (5–7); monitor for unexpected child processes spawned from the NiFi JVM process, particularly on Linux hosts running NiFi 1.17.0–1.21.0. ↗
  • ·The vulnerability requires an authenticated and authorized user; exploitation is not unauthenticated. Detections should still cover insider-threat and compromised-credential scenarios. ↗
  • ·Upgrading to NiFi 1.22.0 disables H2 JDBC URLs in the default configuration; verify the default configuration has not been overridden post-upgrade. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_apache8.8
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.