RCE in Apache Nifi
CVE-2023-36542
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.019 (78.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Nifi
- Apache Software Foundation Nifi — versions 0.0.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (release-notes, Vendor Advisory)
- security@apache.org (vendor-advisory, Mailing List, Issue Tracking, Vendor Advisory)
- security@apache.org (Not Applicable)
- security@apache.org (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-36542?
- CVE-2023-36542 is a high-severity vulnerability in Apache Nifi, classified under Code Injection. CVSS score: 8.8/10. Published 2023-07-29.
- How severe is CVE-2023-36542?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2023-36542 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.