Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-34468

CVE-2023-34468:
Apache NiFi vulnerable to Code Injection

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-34468
GHSA ID
GHSA-xm2m-2q6h-22jw
EPSS Score
0.98907%
CWE
CWE-94
Published
6/12/2023
Updated
2/13/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.nifi:nifi-dbcp-basemaven>= 0.0.2, < 1.22.01.22.0
org.apache.nifi:nifi-hikari-dbcp-servicemaven>= 0.0.2, < 1.22.01.22.0
org.apache.nifi:nifi-dbcp-service-narmaven>= 0.0.2, < 1.22.01.22.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from insufficient validation of Database URL properties in connection pool services. Both DBCP and HikariCP implementations used NON_EMPTY_VALIDATOR which only checked for empty values but didn't restrict dangerous H2 JDBC schemes. The commit introduced ConnectionUrlValidator to explicitly block H2 URLs, indicating these were the vulnerable points. The patch diff clearly shows replacement of the validator in both locations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** ***P*onn**tionPool *n* *ik*ri*P*onn**tionPool *ontroll*r S*rvi**s in *p**** Ni*i *.*.* t*rou** *.**.* *llow *n *ut**nti**t** *n* *ut*oriz** us*r to *on*i*ur* * **t***s* URL wit* t** ** *riv*r t**t *n**l*s *ustom *o** *x**ution. T** r*solution v*

Reasoning

T** vuln*r**ility st*mm** *rom insu**i*i*nt v*li**tion o* **t***s* URL prop*rti*s in *onn**tion pool s*rvi**s. *ot* ***P *n* *ik*ri*P impl*m*nt*tions us** NON_*MPTY_V*LI**TOR w*i** only ****k** *or *mpty v*lu*s *ut *i*n't r*stri*t **n**rous ** J*** s