CVE-2023-36542 json
Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
published 3y ago modified 2mo ago also BIT-nifi-2023-36542 , EUVD-2023-2137 , GHSA-r969-8v3h-23v9
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.
Patch / fix
- maven org.apache.nifi:nifi-cdc-mysql-bundle 1.23.0
- maven org.apache.nifi:nifi-jms-processors 1.23.0
- maven org.apache.nifi:nifi-standard-processors 1.23.0
- maven org.apache.nifi:nifi-dbcp-service 1.23.0
- maven org.apache.nifi:nifi-hikari-dbcp-service 1.23.0
- maven org.apache.nifi:nifi-hadoop-dbcp-service 1.23.0
- maven org.apache.nifi:nifi-hbase_2-client-service 1.23.0
- maven org.apache.nifi:nifi-record-serialization-services 1.23.0
Is CVE-2023-36542 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2y ago
Exploit prediction
1.90% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-15).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.nifi:nifi-cdc-mysql-bundle | >=0.0.2, <1.23.0 |
1.23.0 |
| maven | org.apache.nifi:nifi-jms-processors | >=0.0.2, <1.23.0 |
1.23.0 |
| maven | org.apache.nifi:nifi-standard-processors | >=0.0.2, <1.23.0 |
1.23.0 |
| maven | org.apache.nifi:nifi-dbcp-service | >=0.0.2, <1.23.0 |
1.23.0 |
| maven | org.apache.nifi:nifi-hikari-dbcp-service | >=0.0.2, <1.23.0 |
1.23.0 |
| maven | org.apache.nifi:nifi-hadoop-dbcp-service | >=0.0.2, <1.23.0 |
1.23.0 |
| maven | org.apache.nifi:nifi-hbase_2-client-service | >=0.0.2, <1.23.0 |
1.23.0 |
| maven | org.apache.nifi:nifi-record-serialization-services | >=0.0.2, <1.23.0 |
1.23.0 |
| bitnami | nifi | >=0.0.2, <=1.22.0 |
no fix listed |
Affected products
- Apache Software Foundation Apache NiFi
- apache nifi
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/apache/nifi/commit/532578799c
web
-
lists.apache.org
/thread/swnly3dzhhq9zo3rofc8djq77stkhbof
vendor-advisory, web, issue-tracking, mailing-list, advisory
-
nifi.apache.org
/security.html#CVE-2023-36542
release-notes, web, vendor-advisory, advisory
-
seclists.org
/fulldisclosure/2023/Jul/43
web, not-applicable
-
openwall.com
/lists/oss-security/2023/07/29/1
web, mailing-list, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-36542
advisory, web
-
github.com
/apache/nifi
package
-
issues.apache.org
/jira/browse/NIFI-11744
web
Sources
- CVE List CVE-2023-36542
- GitHub Advisory GHSA-r969-8v3h-23v9
- NVD CVE-2023-36542
- OSV BIT-nifi-2023-36542
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.