CVE-2023-34468 Apache NiFi: Potential Code Injection with Database Services using H2
Authenticated users can execute arbitrary code by configuring malicious H2 database URLs in Apache NiFi connection pools.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-34468?
CVE-2023-34468 is a high-severity code injection vulnerability in Apache Nifi, published on 12 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.
The resolution validates the Database URL and rejects H2 JDBC locations.
You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
Weakness: CWE-94
Which versions are affected by CVE-2023-34468?
7 open source packages ship an affected version, including org.apache.nifi:nifi-dbcp-base, nifi and org.apache.nifi:nifi-dbcp-service-nar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.nifi:nifi-dbcp-base Maven | From 0.0.2 | 1.22.0 |
org.apache.nifi:nifi-dbcp-base Maven | From 0.0.2 | 1.22.0 |
nifi Bitnami | From 0.0.2 | 1.22.0 |
org.apache.nifi:nifi-dbcp-service-nar Maven | From 0.0.2 | 1.22.0 |
org.apache.nifi:nifi-dbcp-service-nar Maven | From 0.0.2 | 1.22.0 |
org.apache.nifi:nifi-hikari-dbcp-service Maven | From 0.0.2 | 1.22.0 |
1 more packages
org.apache.nifi:nifi-hikari-dbcp-service Maven | From 0.0.2 | 1.22.0 |
Products include Apache Nifi.
How do I fix CVE-2023-34468?
Upgrade org.apache.nifi:nifi-dbcp-base to 1.22.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-34468 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-34468 exists.
Public exploit code: 1 Metasploit module and 7 proofs of concept on GitHub.
Other vulnerabilities in Apache Nifi
- CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi
- CVE-2017-15697 Apache NiFi XSS issue in context path handling
- CVE-2017-5636 Injection in Apache NiFi
- CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
Sources
Also known as BIT-nifi-2023-34468, GHSA-xm2m-2q6h-22jw.