Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-52067

CVE-2024-52067: Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log

6.9

CVSS Score
4.0

Basic Information

CVE ID
CVE-2024-52067
GHSA ID
GHSA-v3vc-6qcv-4vrx
EPSS Score
0.34741%
CWE
CWE-532
Published
2/11/2025
Updated
2/11/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:L/U:Green
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.nifi:nifi-framework-coremaven>= 1.16.0, < 1.28.11.28.1
org.apache.nifi:nifi-framework-coremaven>= 2.0.0-M1, <= 2.0.0-M42.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from debug logging of Parameter Context values during flow synchronization. The GitHub patch shows removal of a code block in VersionedFlowSynchronizer.java that: 1) Checked if debug logging was enabled 2) Collected parameter values 3) Logged them using logger.debug(). This matches the vulnerability description where authorized admins could enable debug logging to expose sensitive parameters. The affected function updateParameterContext() was modified in the patch, confirming it as the vulnerable location.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*p**** Ni*i *.**.* t*rou** *.**.* *n* *.*.*-M* t*rou** *.*.*-M* in*lu** option*l ***u* lo**in* o* P*r*m*t*r *ont*xt v*lu*s *urin* t** *low syn**roniz*tion pro**ss. *n *ut*oriz** **ministr*tor wit* ****ss to ***n** lo**in* l*v*ls *oul* *n**l* ***u* lo

Reasoning

T** vuln*r**ility st*ms *rom ***u* lo**in* o* P*r*m*t*r *ont*xt v*lu*s *urin* *low syn**roniz*tion. T** *it*u* p*t** s*ows r*mov*l o* * *o** *lo*k in `V*rsion***lowSyn**roniz*r.j*v*` t**t: *) ****k** i* ***u* lo**in* w*s *n**l** *) *oll**t** p*r*m*t*