CVE-2023-36542
published 2023-07-29CVE-2023-36542: Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an…
PriorityP279high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.99%
78.6th percentile
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | nifi | — | — |
| apache | nifi | 0.0.2 – 1.22.0 | — |
| apache_software_foundation | apache_nifi | 0.0.2 – 1.22.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Affected versions of Apache NiFi are 0.0.2 through 1.22.0; monitor for use of Processors or Controller Services that accept HTTP URL references for driver retrieval, which can enable custom code execution by authenticated users. ↗
- →Alert on configuration changes to NiFi Processors or Controller Services that set HTTP URL properties pointing to remote resources (driver locations), especially by non-privileged users, as this is the exploitation vector. ↗
- →Track Apache NiFi Jira issue NIFI-11744 and GitHub Pull Request 7426 for patch details that introduce the 'Reference Remote Resources' restriction annotation, useful for understanding what components were hardened. ↗
- ·Exploitation requires the attacker to already be authenticated and authorized within Apache NiFi; this is not an unauthenticated remote code execution vulnerability. ↗
- ·The fix in 1.23.0 introduces a new 'Reference Remote Resources' Required Permission; after upgrading, only privileged users can configure the affected Processors and Controller Services — verify privilege assignments post-upgrade. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
vendor_apache8.8
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apache
Apache nifi: CVE-2023-36542
vendor_apache·CVSS 8.8
CVE-2023-36542 Apache nifi: CVE-2023-36542
Apache nifi: CVE-2023-36542
Title: Potential Code Injection with Properties Referencing Remote Resources Published: 2023-07-28 Severity: Medium Products: Apache NiFi Affected Versions: 0.0.2 to 1.22.0 Fixed Versions: 1.23.0 Reporter: nbxiglk References CVE Record: CVE-2023-36542 NVD Record: CVE-2023-36542 Apache Jira Issue: NIFI-11744 GitHub Pull Request: 7426 Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged user
GHSA
Apache NiFi Code Injection vulnerability
ghsa·2023-07-29
CVE-2023-36542 [HIGH] CWE-94 Apache NiFi Code Injection vulnerability
Apache NiFi Code Injection vulnerability
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.
OSV
Apache NiFi Code Injection vulnerability
osv·2023-07-29
CVE-2023-36542 [HIGH] Apache NiFi Code Injection vulnerability
Apache NiFi Code Injection vulnerability
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.
VulnCheck
Apache nifi Improper Control of Generation of Code ('Code Injection')
vulncheck·2023·CVSS 8.8
CVE-2023-36542 [HIGH] Apache nifi Improper Control of Generation of Code ('Code Injection')
Apache nifi Improper Control of Generation of Code ('Code Injection')
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.
Affected: Apache nifi
Required Action: Apply remediations or mitigations per vendor instructions or discontinu
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://seclists.org/fulldisclosure/2023/Jul/43http://www.openwall.com/lists/oss-security/2023/07/29/1https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbofhttps://nifi.apache.org/security.html#CVE-2023-36542http://seclists.org/fulldisclosure/2023/Jul/43http://www.openwall.com/lists/oss-security/2023/07/29/1https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbofhttps://nifi.apache.org/security.html#CVE-2023-36542
2023-07-29
Published
Exploited in the wild