CVE-2024-37389 Apache NiFi: Improper Neutralization of Input in Parameter Context Description
Authenticated users can inject JavaScript into Parameter Context descriptions, leading to session hijacking or account takeover in Apache NiFi.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-37389?
CVE-2024-37389 is a medium-severity cross-site scripting vulnerability in Apache Nifi, published on 8 Jul 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the authenticated user. Upgrading to Apache NiFi 1.27.0 or 2.0.0-M4 is the recommended mitigation.
Weakness: CWE-79
Which versions are affected by CVE-2024-37389?
4 open source packages ship an affected version, including org.apache.nifi:nifi-web-ui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.nifi:nifi-web-ui Maven | From 1.10.0 | 1.27.0 |
org.apache.nifi:nifi-web-ui Maven | From 1.10.0 | 1.27.0 |
org.apache.nifi:nifi-web-ui Maven | From 2.0.0-M1 | 2.0.0-M4 |
org.apache.nifi:nifi-web-ui Maven | From 2.0.0-M1 | 2.0.0-M4 |
Products include Apache Nifi.
How do I fix CVE-2024-37389?
Upgrade org.apache.nifi:nifi-web-ui to a fixed version for your release line: 1.27.0 or 2.0.0-M4.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-37389 being exploited?
There is no known exploitation of CVE-2024-37389 in the wild and no public exploit code.
Other vulnerabilities in Apache Nifi
- CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi
- CVE-2017-15697 Apache NiFi XSS issue in context path handling
- CVE-2017-5636 Injection in Apache NiFi
- CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
Sources
Also known as GHSA-h658-qqv9-qwv8.