CVE-2023-34212 PoC — Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

Source

Associated Vulnerability

Description

CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi

Readme

# CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi

The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://nifi.apache.org/security.html#CVE-2023-34212).

### Requirements:

This vulnerability requires:
<br/>
- Valid user credentials

### Proof Of Concept:

More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2023-34212/blob/main/Apache%20NiFi%20-%20CVE-2023-34212.pdf).

### Additional Resources:

Kudos to [Veraxy00 of Qianxin TI Center](https://github.com/Veraxy00) for discovering and reporting the vulnerability in the same time period as me.

[CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi](https://github.com/mbadanoiu/CVE-2023-40037) can be used to bypass security measures implemented for CVE-2023-34212 resulting in RCE for versions of Apache NiFi <= 1.23.0.

File Snapshot

 [4.0K]  /data/pocs/f260b3e483323daa60ea7a4bbf1ce47861d9a48d
├── [2.2M]  Apache NiFi - CVE-2023-34212.pdf
└── [1.2K]  README.md

0 directories, 2 files

Remarks