PT-2023-5706 · Apache · Apache Nifi

Nbxiglk · Published 2023-07-28 · Updated 2025-09-12 · CVE-2023-36542

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 0.0.2 through 1.22.0

Description The issue is related to the Remote Resource Handler component of Apache NiFi, which is associated with incorrect code generation management. This can allow a remote attacker to execute arbitrary code. The vulnerability is exploited when an authenticated and authorized user configures a location that enables custom code execution, using HTTP URL references for retrieving drivers in Processors and Controller Services.

Recommendations For Apache NiFi versions 0.0.2 through 1.22.0, upgrade to Apache NiFi 1.23.0 to mitigate the issue. This version introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2023-06376

BIT-NIFI-2023-36542

CVE-2023-36542

GHSA-R969-8V3H-23V9

Affected Products

Apache Nifi

References · 16

• https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof · Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2023-36542 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nifi-2023-36542 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36542 · Security Note
• https://osv.dev/vulnerability/GHSA-r969-8v3h-23v9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36542 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06376 · Security Note
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/commit/532578799c · Note
• http://seclists.org/fulldisclosure/2023/Jul/43 · Note
• http://openwall.com/lists/oss-security/2023/07/29/1 · Note
• https://issues.apache.org/jira/browse/NIFI-11744 · Note
• https://t.me/cvenotify/55522 · Telegram Post
• https://t.me/cvenotify/96929 · Telegram Post
• https://twitter.com/rst_cloud/status/1837592396185354311 · Twitter Post