CVE-2023-36542: apache software foundation apache nifi Code Injection

Vulnerability summary

CVE-2023-36542 is a high (CVSS 8.8) Code Injection vulnerability in apache software foundation apache nifi. EPSS estimates a 1.90% chance of exploitation in the next 30 days, higher than 79.3% of scored vulnerabilities.

Timeline

1. 29-07-2023
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.