Apache NiFi information disclosure by XXE

Vulnerability

The TransformXML processor in Apache NiFi before version 1.15.1 allows an authenticated user to configure an XSLT file. If the XSLT file includes malicious external entity (XXE) calls, it may reveal sensitive information. This issue is tracked as NIFI-9399 [1][3].

Exploitation

An attacker must be an authenticated user with permission to configure the TransformXML processor. The attacker provides a crafted XSLT file that includes external entity references. When the processor processes the XSLT, the XML parser resolves the external entities, potentially reading local files or making network requests [2][3].

Impact

Successful exploitation leads to information disclosure. The attacker can read sensitive files from the NiFi server's file system or access internal network resources, depending on the external entity definitions. The privilege level is that of an authenticated user, but the disclosure can expose credentials or configuration data [1][2].

Mitigation

The vulnerability is fixed in Apache NiFi version 1.15.1, released on December 17, 2021 [1][3]. Users should upgrade to 1.15.1 or later. No workaround is documented; upgrading is the recommended mitigation. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.