PT-2021-20073 · Apache · Apache Nifi Minifi C++

Arpad Boda · Published 2021-08-24 · Updated 2021-08-31 · CVE-2021-33191

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache NiFi MiNiFi C++ versions 0.5.0 through 0.9.x

Description The c2 protocol in Apache NiFi MiNiFi C++ implements an "agent-update" command designed to patch the application binary. This command defaults to calling a trusted binary but can be modified to an arbitrary value through a "c2-update" command. The modified command is then executed with the same privileges as the application binary.

Recommendations For versions 0.5.0 through 0.9.x, update to version 0.10.0 to address the issue. As a temporary workaround, consider restricting access to the "c2-update" command to prevent modification of the "agent-update" command until a patch is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-33191

Affected Products

Apache Nifi Minifi C++

References · 7

• https://osv.dev/vulnerability/CVE-2021-33191 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33191 · Security Note
• http://openwall.com/lists/oss-security/2021/08/24/1 · Note
• https://t.me/cibsecurity/27763 · Telegram Post
• https://t.me/cvenotify/20001 · Telegram Post
• https://openwall.com/lists/oss-security/2021/08/24/1 · Note
• https://lists.apache.org/thread.html/r6f27a2454f5f67dbe4e21c8eb1db537b01863a0bc3758f28aa60f032%40%3Cannounce.apache.org%3E · Note