Vulnerability description
Apache NiFi is an open source data flow processing and automation tool, and the JndiJmsConnectionFactoryProvider controller component is used to configure the JMS connection address.
In Apache NiFi versions 1.8.0 to 1.21.0, since the JndiJmsConnectionFactoryProvider controller service allows authorized users to configure the URL and library properties, an authenticated attacker can configure the JndiJmsConnectionFactoryProvider's JMS connection address in the ConnectionFactory to a malicious JNDI server , to remotely execute malicious code by deserializing maliciously constructed data.
Users can mitigate this vulnerability by upgrading to NiFi 1.22.0 or configuring the org.apache.nifi.jms.cf.jndi.provider.url.schemes.allowed property in bootstrap.conf to disable the LDAP function of JNDI URL.
| Vulnerability name | Apache Nifi JMS component has JNDI deserialization vulnerability |
|---|---|
| Vulnerability type | deserialization |
| Discovery time | 2023/6/13 |
| Vulnerability Breadth | generally |
| MPS number | MPS-y8rd-wenb |
| CVE number | CVE-2023-34212 |
| CNVD number | - |
Sphere of influence
org.apache.nifi:nifi@[1.8.0, 1.22.0);
Repair plan
Upgrade org.apache.nifi:nifi to version 1.22.0 and above
Configure the org.apache.nifi.jms.cf.jndi.provider.url.schemes.allowed property in bootstrap.conf to disable the LDAP function of the JNDI URL
reference link
https://nvd.nist.gov/vuln/detail/CVE-2023-34212
https://issues.apache.org/jira/browse/NIFI-11614
https://github.com/apache/nifi/pull/7313
https://github.com/apache/nifi/commit/3fcb82ee4509d1ad73893d8dca003be6d086c5d6
About Murphy Security
Murphy Security is a technology company that provides you with professional software supply chain security management. The core team comes from Baidu, Huawei, Wuyun and other enterprises. The company provides customers with a complete software supply chain security management platform, and provides software with a full life cycle around SBOM Security management, platform capabilities include software component analysis, source security management, container image detection, vulnerability intelligence early warning and commercial software supply chain access assessment and other products. Provide customers with complete control capabilities from supply chain asset identification management, risk detection, security control, and one-key repair.
Open source project: https://github.com/murphysecurity/murphysec/?sf=qbyj
The product can be integrated with various tools in the existing development process at a very low cost, including seamless integration with dozens of tools such as IDE, Gitlab, Bitbucket, Jenkins, Harbor, and Nexus.
Free code security detection tool: https://www.murphysec.com/?sf=qbyj
Free intelligence subscription: https://www.oscs1024.com/cm/?sf=qbyj