Multiple vulnerabilities in Apache Nifi



Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2018-1310
CVE-2018-1309
CVE-2017-8028
CVE-2018-1324
CWE-ID CWE-502
CWE-611
CWE-592
CWE-835
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Apache Nifi
Server applications / Database software

Vendor Apache Foundation

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Deserialization of untrusted data

EUVDB-ID: #VU13036

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1310

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to unsafe deserialization of Java Message Service (JMS) content by an ActiveMQ client affected by the vulnerability identified as CVE-2015-5254. A remote attacker can send a specially crafted request that submits malicious JMS content and cause the affected software to become unresponsive or crash, resulting in a DoS condition.

Mitigation

Update to version 1.6.

Vulnerable software versions

Apache Nifi: 0.1 - 1.5

CPE2.3 External links

https://nifi.apache.org/security.html#CVE-2018-1310


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) XXE attack

EUVDB-ID: #VU13038

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-1309

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote attacker to conduct XXE-attack on the target system.

The vulnerability exists due to improper parsing of XML content by the SplitXML processor. A remote attacker can send a specially crafted request that submits malicious XML content to the targeted system and execute arbitrary code or access sensitive information on the system, which could be used to conduct further attacks.

Mitigation

Update to version 1.6.

Vulnerable software versions

Apache Nifi: 0.1 - 1.5

CPE2.3 External links

https://nifi.apache.org/security.html#CVE-2018-1309


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Authentication bypass

EUVDB-ID: #VU9424

Risk: Low

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-8028

CWE-ID: CWE-592 - Authentication Bypass Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication on the target system.

The weakness exists due to some LDAP vendors require an explicit operation for the LDAP bind to take effect. A remote attacker with knowledge of the username can authenticate with an arbitrary password when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch.

Mitigation

Update to version 1.6.

Vulnerable software versions

Apache Nifi: 0.1 - 1.5

CPE2.3 External links

https://nifi.apache.org/security.html#CVE-2017-8028


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Infinite loop

EUVDB-ID: #VU11170

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1324

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to an error the ZipFile and ZipArchiveInputStream classes when handling malicious input. A remote attacker can send a specially crafted ZIP archive, trigger an infinite loop and cause the service to crash.

Mitigation

Update to version 1.6.

Vulnerable software versions

Apache Nifi: 0.1 - 1.5

CPE2.3 External links

https://nifi.apache.org/security.html#CVE-2018-1324


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###