-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in the GetAsanaObject processor of Apache NiFi, which uses an insecure method for deserializing state information from a cache. The root cause is the use of java.io.ObjectInputStream without any filtering, which is known to be vulnerable to remote code execution attacks. The provided patch addresses this by replacing the generic Java serialization with a more specific and safe JSON-based serialization using Gson. The vulnerable function is org.apache.nifi.processors.asana.GenericObjectSerDe.deserialize, which was responsible for the unsafe deserialization. An attacker with access to the cache server could insert a malicious serialized Java object, which would then be executed when the GetAsanaObject processor attempts to retrieve its state.
org.apache.nifi.processors.asana.GenericObjectSerDe.deserializenifi-extension-bundles/nifi-asana-bundle/nifi-asana-processors/src/main/java/org/apache/nifi/processors/asana/StringSerDe.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.nifi:nifi-asana-processors | maven | >= 1.20.0, < 2.7.0 | 2.7.0 |
A Semantic Attack on Google Gemini - Read the Latest Research