Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
HackTheBox - Helix 💥 CVE-2023-40037 → RCE en NiFi 🔑 Backup de clave privada SSH ⚙️ OPC UA + sudo https://sckull.github.io/posts/helix/
Post summary
The post announces CVE-2023-40037 as a remote code execution flaw in Apache NiFi and links to a blog post that presumably contains proof of concept details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | nifi | - | - | - |