CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi

The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.

Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found here.

Requirements:

This vulnerability requires:

• Valid user credentials

Proof Of Concept:

More details and the exploitation process can be found in this PDF.

Additional Resources:

Kudos to Veraxy00 of Qianxin TI Center for discovering and reporting the vulnerability in the same time period as me.

CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi can be used to bypass security measures implemented for CVE-2023-34212 resulting in RCE for versions of Apache NiFi <= 1.23.0.