CVE-2023-49145 Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
Authenticated users can execute arbitrary JavaScript via a crafted URL in the JoltTransformJSON processor interface, potentially leading to session hijacking.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-49145?
CVE-2023-49145 is a high-severity cross-site scripting vulnerability in Apache Nifi, published on 27 Nov 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation.
Weakness: CWE-79
Which versions are affected by CVE-2023-49145?
3 open source packages ship an affected version, including org.apache.nifi:nifi-jolt-transform-json-ui and nifi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.nifi:nifi-jolt-transform-json-ui Maven | All versions | 1.24.0 |
org.apache.nifi:nifi-jolt-transform-json-ui Maven | All versions | 1.24.0 |
nifi Bitnami | From 0.7.0 | 1.24.0 |
Products include Apache Nifi.
How do I fix CVE-2023-49145?
Upgrade org.apache.nifi:nifi-jolt-transform-json-ui to 1.24.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-49145 being exploited?
There is no known exploitation of CVE-2023-49145 in the wild and no public exploit code.
Other vulnerabilities in Apache Nifi
- CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi
- CVE-2017-15697 Apache NiFi XSS issue in context path handling
- CVE-2017-5636 Injection in Apache NiFi
- CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
Sources
Also known as BIT-nifi-2023-49145, GHSA-68pr-6fjc-wmgm.