{"id":"CVE-2023-36542","published":"2023-07-29T07:12:18Z","modified":"2025-02-13T16:56:21Z","title":"Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources","vendor":"Apache Software Foundation","product":"Apache NiFi","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache NiFi","versions":[">= 0.0.2, <= 1.22.0"]}],"description":{"text":"Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.01903,"percentile":0.79677,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-09-18","exploitedFirstSeen":"2024-09-18","ransomware":false,"evidence":[{"url":"https://media.defense.gov/2024/Sep/18/2003547016/-1/-1/0/CSA-PRC-LINKED-ACTORS-BOTNET.PDF","date":"2024-09-18"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":6,"pulses":[{"name":"Update 10: Cybercriminals Leverage 66 Vulnerabilities to Target Global Systems","url":"https://otx.alienvault.com/pulse/68651d685fb2301208e89b10","created":"2025-07-02"},{"name":"NCSC Advisory - 18th Sept 2024 - PRC Botnet","url":"https://otx.alienvault.com/pulse/678638141cbf938dbca1090d","created":"2025-01-14"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/677cd56c6fd3f2632e1b4411","created":"2025-01-07"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/677cd54761ae1299ecfe27aa","created":"2025-01-07"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/66fd391fe0318d98f8af0eb4","created":"2024-10-02"},{"name":"CSA-PRC-LINKED-ACTORS-BOTNET","url":"https://otx.alienvault.com/pulse/66ebe08841abbc50444fbcae","created":"2024-09-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://nifi.apache.org/security.html#CVE-2023-36542","tags":["release-notes"]},{"url":"https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof","tags":["vendor-advisory"]},{"url":"http://seclists.org/fulldisclosure/2023/Jul/43","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2023/07/29/1","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.nifi:nifi-cdc-mysql-bundle","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"from":["GHSA-r969-8v3h-23v9"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.nifi:nifi-jms-processors","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"from":["GHSA-r969-8v3h-23v9"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.nifi:nifi-standard-processors","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"from":["GHSA-r969-8v3h-23v9"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.nifi:nifi-dbcp-service","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"from":["GHSA-r969-8v3h-23v9"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.nifi:nifi-hikari-dbcp-service","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"from":["GHSA-r969-8v3h-23v9"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.nifi:nifi-hadoop-dbcp-service","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"from":["GHSA-r969-8v3h-23v9"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.nifi:nifi-hbase_2-client-service","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"from":["GHSA-r969-8v3h-23v9"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.nifi:nifi-record-serialization-services","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"from":["GHSA-r969-8v3h-23v9"],"provenance":"source"}],"advisories":[{"id":"GHSA-r969-8v3h-23v9","url":"https://github.com/advisories/GHSA-r969-8v3h-23v9","severity":"HIGH","ecosystem":"Maven","package":"org.apache.nifi:nifi-cdc-mysql-bundle","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-r969-8v3h-23v9","url":"https://github.com/advisories/GHSA-r969-8v3h-23v9","severity":"HIGH","ecosystem":"Maven","package":"org.apache.nifi:nifi-jms-processors","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-r969-8v3h-23v9","url":"https://github.com/advisories/GHSA-r969-8v3h-23v9","severity":"HIGH","ecosystem":"Maven","package":"org.apache.nifi:nifi-standard-processors","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-r969-8v3h-23v9","url":"https://github.com/advisories/GHSA-r969-8v3h-23v9","severity":"HIGH","ecosystem":"Maven","package":"org.apache.nifi:nifi-dbcp-service","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-r969-8v3h-23v9","url":"https://github.com/advisories/GHSA-r969-8v3h-23v9","severity":"HIGH","ecosystem":"Maven","package":"org.apache.nifi:nifi-hikari-dbcp-service","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-r969-8v3h-23v9","url":"https://github.com/advisories/GHSA-r969-8v3h-23v9","severity":"HIGH","ecosystem":"Maven","package":"org.apache.nifi:nifi-hadoop-dbcp-service","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-r969-8v3h-23v9","url":"https://github.com/advisories/GHSA-r969-8v3h-23v9","severity":"HIGH","ecosystem":"Maven","package":"org.apache.nifi:nifi-hbase_2-client-service","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-r969-8v3h-23v9","url":"https://github.com/advisories/GHSA-r969-8v3h-23v9","severity":"HIGH","ecosystem":"Maven","package":"org.apache.nifi:nifi-record-serialization-services","vulnerableRanges":[">=0.0.2, <1.23.0"],"patched":["1.23.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2137","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2137","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-07-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-36542","provenance":"source"},{"date":"2024-09-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://media.defense.gov/2024/Sep/18/2003547016/-1/-1/0/CSA-PRC-LINKED-ACTORS-BOTNET.PDF","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":59.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 773 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":15.94,"detail":"percentile 0.7968"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-nifi-cve-2023-34212","parents":[{"from":"CVE-2023-34468","to":"CVE-2023-36542","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.nifi:nifi-hikari-dbcp-service","fromFixed":"1.22.0","toFixed":"1.23.0","daysApart":47},{"kind":"same-code","provenance":"machine","files":["nifi-nar-bundles/nifi-standard-services/nifi-dbcp-service-bundle/nifi-hikari-dbcp-service/src/main/java/org/apache/nifi/dbcp/HikariCPConnectionPool.java"],"commits":["https://github.com/apache/nifi/commit/4faf3ea59895e7e153db3f8f61147ff70a254361","https://github.com/apache/nifi/commit/532578799c0a4cb1edc54dadda81aa60787e54b0"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2023-36542","to":"CVE-2023-40037","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.nifi:nifi-jms-processors","fromFixed":"1.23.0","toFixed":"1.23.1","daysApart":20},{"kind":"same-code","provenance":"machine","files":["nifi-nar-bundles/nifi-standard-services/nifi-dbcp-service-bundle/nifi-hikari-dbcp-service/src/main/java/org/apache/nifi/dbcp/HikariCPConnectionPool.java"],"commits":["https://github.com/apache/nifi/commit/532578799c0a4cb1edc54dadda81aa60787e54b0","https://github.com/apache/nifi/commit/064550aacc189f39d7ddd2c0446068adf250f1bf"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.3,"basis":"same product + description similarity"}]}],"packageHistory":[{"cve":"CVE-2023-34212","published":"2023-06-12","fixed":"1.22.0","kev":false,"link":{"from":"CVE-2023-34212","to":"CVE-2023-36542","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.nifi:nifi-jms-processors","fromFixed":"1.22.0","toFixed":"1.23.0","daysApart":47}]}},{"cve":"CVE-2023-36542","published":"2023-07-29","fixed":"1.23.0","kev":false},{"cve":"CVE-2023-40037","published":"2023-08-18","fixed":"1.23.1","kev":false}],"package":"Maven:org.apache.nifi:nifi-jms-processors"}}