CVE-2018-17195 Cleartext Transmission of Sensitive Information in Apache nifi
An attacker can perform CSRF attacks on the template upload API via MiTM, potentially injecting malicious code or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-17195?
CVE-2018-17195 is a high-severity vulnerability in Apache Nifi, published on 19 Dec 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access, and injecting malicious code into an unprotected (plaintext HTTP) website which the targeted user later visits, but the possible damage warranted a Severe severity level. Mitigation: The fix to apply Cross-Origin Resource Sharing (CORS) policy request filtering was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Which versions are affected by CVE-2018-17195?
2 open source packages ship an affected version, including org.apache.nifi:nifi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.nifi:nifi Maven | From 1.0.0 | 1.8.0 |
org.apache.nifi:nifi Maven | From 1.0.0 | 1.8.0 |
Products include Apache Nifi.
How do I fix CVE-2018-17195?
Upgrade org.apache.nifi:nifi to 1.8.0 or later.
Is CVE-2018-17195 being exploited?
There is no known exploitation of CVE-2018-17195 in the wild and no public exploit code.
Other vulnerabilities in Apache Nifi
- CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi
- CVE-2017-15697 Apache NiFi XSS issue in context path handling
- CVE-2017-5636 Injection in Apache NiFi
- CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
Sources
Also known as GHSA-3jq8-jg75-rqv6.