CVE-2023-36542

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://seclists.org/fulldisclosure/2023/Jul/43	Not Applicable
http://www.openwall.com/lists/oss-security/2023/07/29/1	Mailing List Third Party Advisory
https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof	Issue Tracking Mailing List Vendor Advisory
https://nifi.apache.org/security.html#CVE-2023-36542	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-07-29 08:15

Updated : 2023-08-03 19:09

NVD link : CVE-2023-36542

Mitre link : CVE-2023-36542

CVE.ORG link : CVE-2023-36542

JSON object : View

Products Affected

apache

nifi

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2023-36542", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-07-29T08:15:48.833", "references": [{"url": "http://seclists.org/fulldisclosure/2023/Jul/43", "tags": ["Not Applicable"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2023/07/29/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof", "tags": ["Issue Tracking", "Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://nifi.apache.org/security.html#CVE-2023-36542", "tags": ["Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.\n"}], "lastModified": "2023-08-03T19:09:29.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C3B1469-F3F7-42FD-AB7A-A4B46384EB02", "versionEndIncluding": "1.22.0", "versionStartIncluding": "0.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}