CVE-2019-10080

Vulnerability

Overview

CVE-2019-10080 is an XML External Entity (XXE) processing vulnerability in Apache NiFi's XMLFileLookupService, affecting versions 1.3.0 through 1.9.2 [2]. The service allowed trusted users to inadvertently configure a potentially malicious XML file. The root cause was the lack of proper XXE protections in the XML parsing configuration [3].

Attack

Vector

The vulnerability requires authenticated access with privileges to configure the XMLFileLookupService [1]. An attacker with those privileges could upload or modify an XML file containing external entity declarations. When the service processes this file, the XML parser would expand external entities, making HTTP requests to attacker-controlled servers [2].

Impact

Successful exploitation allows the attacker to exfiltrate information about the NiFi instance, including the versions of Java, Jersey, and Apache running on the server [2]. This information leakage could aid in further targeted attacks. The XXE capability itself could potentially be used for server-side request forgery (SSRF) or file disclosure, though the advisory primarily highlights information gathering [1].

Mitigation

Apache NiFi addressed this issue in version 1.9.2 with the fix merged in pull request #3507 [3]. The patch introduced a SafeXMLConfiguration class that disables Document Type Definitions (DTDs) and external entity processing, thereby preventing XXE attacks [3]. Users should upgrade to NiFi 1.9.2 or later. No workarounds were documented, but restricting trusted user privileges and monitoring unusual outbound HTTP requests from NiFi may help detect exploitation.