CVE-2017-12632

Vulnerability

Apache NiFi versions 1.x prior to 1.5.0 are vulnerable to an HTTP Host header injection attack. A malicious Host header in an incoming HTTP request can cause NiFi to load resources from an external server, bypassing intended controls. The fix involves sanitizing the Host header and comparing it against a controlled whitelist [1][2].

Exploitation

An attacker with network access to an affected NiFi instance can craft an HTTP request with a malicious Host header. No authentication or user interaction is required beyond the ability to send an HTTP request to the NiFi server. The malicious header causes NiFi to retrieve resources from an attacker-controlled external server [1][2].

Impact

Successful exploitation allows an attacker to cause NiFi to load resources from an external server, potentially leading to the execution of untrusted code or data exfiltration. The impact is limited to the server-side processing of the malicious Host header, and the attacker does not gain direct access to internal resources beyond what is achievable through the loaded external content [1][2].

Mitigation

The vulnerability is fixed in Apache NiFi version 1.5.0, released on an unspecified date. Users running any prior 1.x release should upgrade to version 1.5.0 or later. No workarounds are documented, and there is no indication that this CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog [1][2].