PT-2023-5586 · Apache · Apache Nifi

Mal + 1 · Published 2023-06-12 · Updated 2025-09-12 · CVE-2023-34468

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 0.0.2 through 1.21.0

Description The issue in Apache NiFi is related to the DBCPConnectionPool and HikariCPConnectionPool Controller Services, which allow an authenticated and authorized user to configure a Database URL with the H2 driver, enabling custom code execution. This can be exploited by a remote attacker to execute arbitrary code. Thousands of organizations are impacted by this issue. The resolution involves validating the Database URL and rejecting H2 JDBC locations.

Recommendations For Apache NiFi versions 0.0.2 through 1.21.0, upgrade to version 1.22.0 or later, which fixes this issue. As a temporary workaround, consider restricting the use of the H2 driver in the Database URL configuration to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2023-06240

BIT-NIFI-2023-34468

CVE-2023-34468

GHSA-XM2M-2Q6H-22JW

Affected Products

Apache Nifi

References · 28

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_nifi_h2_rce.rb · Exploit
• 🔥 https://github.com/mbadanoiu/CVE-2023-34468 · Exploit
• 🔥 https://github.com/Al3xx-sec/CVE-2023-34468-POC · Exploit
• https://osv.dev/vulnerability/GHSA-xm2m-2q6h-22jw · Vendor Advisory
• https://lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34468 · Security Note
• https://nifi.apache.org/security.html#CVE-2023-34468 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06240 · Security Note
• https://osv.dev/vulnerability/BIT-nifi-2023-34468 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34468 · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/pull/7349 · Note
• https://github.com/apache/nifi/commit/4faf3ea59895e7e153db3f8f61147ff70a254361 · Note
• https://twitter.com/BlackByte_/status/1707729490061750582 · Twitter Post
• https://t.me/cvenotify/58931 · Telegram Post