Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-17194

CVE-2018-17194: Apache NiFi Improper Input Validation vulnerability

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-17194
GHSA ID
GHSA-43fp-vwwg-qgv6
EPSS Score
0.78123%
CWE
CWE-20
Published
12/20/2018
Updated
3/4/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.nifi:nifi-framework-clustermaven>= 1.0.0, <= 1.7.11.8.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper Content-Length handling during DELETE request replication. The patch introduced the 'checkContentLengthHeader' function to validate()/override this header, which is called from prepareRequest. In vulnerable versions, prepareRequest lacked this validation, making it the entry point for the flawed logic. The function's responsibility to prepare HTTP requests without proper input validation directly enabled the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W**n * *li*nt r*qu*st to * *lust*r no** w*s r*pli**t** to ot**r no**s in t** *lust*r *or v*ri*i**tion, t** *ont*nt-L*n*t* w*s *orw*r***. On * **L*T* r*qu*st, t** *o*y w*s i*nor**, *ut i* t** initi*l r*qu*st *** * *ont*nt-L*n*t* v*lu* ot**r t**n *, t*

Reasoning

T** vuln*r**ility st*ms *rom improp*r *ont*nt-L*n*t* **n*lin* *urin* **L*T* r*qu*st r*pli**tion. T** p*t** intro*u*** t** '****k*ont*ntL*n*t******r' *un*tion to `v*li**t*()`/ov*rri** t*is *****r, w*i** is **ll** *rom `pr*p*r*R*qu*st`. In vuln*r**l* v