PT-2023-24742 · Apache · Apache Nifi

Mal + 2 · Published 2023-06-12 · Updated 2025-09-12 · CVE-2023-34212

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.8.0 through 1.21.0

Description The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location. The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.

Recommendations Upgrade to version 1.22.0 or later, which fixes this issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BIT-NIFI-2023-34212

CVE-2023-34212

GHSA-65WH-G8X8-GM2H

Affected Products

Apache Nifi

References · 16

• 🔥 https://github.com/mbadanoiu/CVE-2023-34212 · Exploit
• https://nifi.apache.org/security.html#CVE-2023-34212 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nifi-2023-34212 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34212 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-65wh-g8x8-gm2h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34212 · Security Note
• https://lists.apache.org/thread/w5rm46fxmvxy216tglf0dv83wo6gnzr5 · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/pull/7313 · Note
• https://github.com/apache/nifi/commit/3fcb82ee4509d1ad73893d8dca003be6d086c5d6 · Note
• http://openwall.com/lists/oss-security/2023/06/12/2 · Note
• https://t.me/cvenotify/52150 · Telegram Post
• https://t.me/cybersecuritytechnologies/9462 · Telegram Post
• https://t.me/pentestingnews/41411 · Telegram Post
• https://t.me/ckure/13261 · Telegram Post