Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2023-34468 BIT-nifi-2023-34468EUVD-2023-1917GHSA-xm2m-2q6h-22jw

Apache NiFi: Potential Code Injection with Database Services using H2

Published Jun 12, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache NiFi Package: org.apache.nifi:nifi-dbcp-base Package: org.apache.nifi:nifi-dbcp-service-nar Package: org.apache.nifi:nifi-hikari-dbcp-service Ecosystem: Maven

Description

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache NiFi 0.0.2 – ≤ 1.21.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

GitHub 8 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.nifi:nifi-dbcp-base >= 0.0.2, < 1.22.0 1.22.0 GHSA-xm2m-2q6h-22jw
Maven org.apache.nifi:nifi-dbcp-service-nar >= 0.0.2, < 1.22.0 1.22.0 GHSA-xm2m-2q6h-22jw
Maven org.apache.nifi:nifi-hikari-dbcp-service >= 0.0.2, < 1.22.0 1.22.0 GHSA-xm2m-2q6h-22jw

Advisories 1

References