PT-2023-5706 · Apache · Apache Nifi

Nbxiglk · Publicado 2023-07-28 · Atualizado 2025-09-12 · CVE-2023-36542

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 0.0.2 through 1.22.0

Description The issue is related to the Remote Resource Handler component of Apache NiFi, which is associated with incorrect code generation management. This can allow a remote attacker to execute arbitrary code. The vulnerability is exploited when an authenticated and authorized user configures a location that enables custom code execution, using HTTP URL references for retrieving drivers in Processors and Controller Services.

Recommendations For Apache NiFi versions 0.0.2 through 1.22.0, upgrade to Apache NiFi 1.23.0 to mitigate the issue. This version introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2023-06376

BIT-NIFI-2023-36542

CVE-2023-36542

GHSA-R969-8V3H-23V9

Produtos afetados

Apache Nifi

Referências · 16

• https://github.com/apache/nifi · Nota
• https://github.com/apache/nifi/commit/532578799c · Nota
• https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof · Aviso do Fabricante
• https://nifi.apache.org/security.html#CVE-2023-36542 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-nifi-2023-36542 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36542 · Nota de Segurança
• http://seclists.org/fulldisclosure/2023/Jul/43 · Nota
• http://openwall.com/lists/oss-security/2023/07/29/1 · Nota
• https://osv.dev/vulnerability/GHSA-r969-8v3h-23v9 · Aviso do Fabricante
• https://issues.apache.org/jira/browse/NIFI-11744 · Nota
• https://t.me/cvenotify/55522 · Publicação no Telegram
• https://t.me/cvenotify/96929 · Publicação no Telegram
• https://twitter.com/rst_cloud/status/1837592396185354311 · Publicação no Twitter
• https://vuldb.com/?id.235752 · Nota
• https://osv.dev/vulnerability/CVE-2023-36542 · Aviso do Fabricante