CVE-2017-15697

Vulnerability

Apache NiFi versions prior to 1.5.0 are vulnerable to remote code execution via a malicious X-ProxyContextPath or X-Forwarded-Context HTTP header. An unauthenticated attacker can inject external resources or embedded code through these headers, which are processed unsafely by the NiFi web server. The vulnerability affects all Apache NiFi 1.x releases before 1.5.0 [1][2].

Exploitation

An attacker with network access to an Apache NiFi instance can craft an HTTP request containing a specially crafted X-ProxyContextPath or X-Forwarded-Context header. No authentication is required. The attacker includes external resources or embedded code in the header value, which the NiFi server then processes in an unsafe manner, leading to code execution on the server [1].

Impact

Successful exploitation allows an attacker to achieve remote code execution (RCE) on the Apache NiFi server. This grants the attacker the ability to execute arbitrary commands or scripts with the privileges of the NiFi process, resulting in full compromise of the application and potentially the underlying host [2].

Mitigation

The vulnerability is fixed in Apache NiFi 1.5.0, released on this date. Users running any prior 1.x release should upgrade to Apache NiFi 1.5.0 or later immediately. No workarounds are mentioned in available references [1][2].