What is CVE-2021-33191?

CVE-2021-33191 is a critical-severity vulnerability in Apache Nifi Minifi C\+\+, classified under OS Command Injection. CVSS score: 9.8/10. Published 2021-08-24.

How severe is CVE-2021-33191?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Apache Nifi Minifi C\+\+

CVE-2021-33191

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command is then executed using the same privileges as the application binary. This was addressed in version 0.10.0

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.040 (89.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Nifi_minifi_c\+\+
Apache Software Foundation Nifi - Minifi C++ — versions 0.5.0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

security@apache.org (Mailing List, Third Party Advisory, x_refsource_MISC)
security@apache.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
security@apache.org (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2021-33191?: CVE-2021-33191 is a critical-severity vulnerability in Apache Nifi Minifi C\+\+, classified under OS Command Injection. CVSS score: 9.8/10. Published 2021-08-24.
How severe is CVE-2021-33191?: Critical severity. CVSS v3 base score is 9.8 out of 10.