Andy Lopresto

**Name of the Vulnerable Software and Affected Versions** NiFi Registry versions 0.1.0 through 0.5.0 **Description** The issue arises when NiFi Registry uses an authentication mechanism other than PKI. Upon clicking Log Out, NiFi Registry invalidates the authentication token on the client side but fails to do so on the server side. This allows the user's client-side token to be used for up to 12 hours after logging out, enabling unauthorized API requests to NiFi Registry. **Recommendations** For NiFi Registry versions 0.1.0 through 0.5.0, consider implementing a server-side token invalidation mechanism to prevent unauthorized access after a user logs out. As a temporary workaround, restrict API requests for a period of up to 12 hours after a user logs out to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi versions 0.0.1 through 1.11.0 **Description** The issue concerns the flow fingerprint factory in Apache NiFi, which generated flow fingerprints that included sensitive property descriptor values. When a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprints of both the cluster and local flow were printed, potentially exposing sensitive values in plaintext. **Recommendations** For Apache NiFi versions 0.0.1 through 1.11.0, consider restricting access to the flow fingerprint factory to minimize the risk of sensitive information exposure until a fix is available.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi version 1.10.0 **Description** An information disclosure issue was found in the sensitive parameter parser, which would log parsed values for debugging purposes. This exposes literal values entered in a sensitive property when no parameter is present. **Recommendations** For Apache NiFi version 1.10.0, consider disabling the sensitive parameter parser's debugging logging to prevent exposure of sensitive information. Restrict access to the logs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi versions prior to 1.8.0 **Description** The issue occurs when a client request to a cluster node is replicated to other nodes for verification, and the Content-Length is forwarded. Specifically, on a DELETE request, the body is ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. **Recommendations** For Apache NiFi versions prior to 1.8.0, upgrade to Apache NiFi 1.8.0 or a later version to apply the fix that checks DELETE requests and overwrites non-zero Content-Length header values.

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions prior to 1.5.0 Description: A malicious `X-ProxyContextPath` or `X-Forwarded-Context` header containing external resources or embedded code could cause remote code execution. Recommendations: For Apache NiFi versions prior to 1.5.0, upgrade to Apache NiFi 1.5.0 or a later version to properly handle these headers and prevent remote code execution. As a temporary workaround, consider restricting access to the `X-ProxyContextPath` and `X-Forwarded-Context` headers until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi versions prior to 0.7.2 Apache NiFi versions 1.x prior to 1.1.2 **Description** The issue allows a carefully crafted `username` to impersonate another user and gain their permissions on a replicated request to another node in a cluster environment. This is due to a vulnerability in the proxy chain serialization/deserialization. **Recommendations** For Apache NiFi versions prior to 0.7.2, update to version 0.7.2 or later. For Apache NiFi versions 1.x prior to 1.1.2, update to version 1.1.2 or later.