Improper Restriction of XML External Entity References in Multiple Components

Vulnerability

Multiple components in Apache NiFi versions 0.0.1 through 1.16.0 do not restrict XML External Entity (XXE) references in their default configuration [1], [2]. The Standard Content Viewer service resolves XXE references when viewing formatted XML files. Additionally, three Processors—EvaluateXPath, EvaluateXQuery, and ValidateXml—resolve XXE references when configured with default property values [2]. This allows malicious XML documents containing Document Type Declarations with XXE references to be processed by affected NiFi flows [2].

Exploitation

An attacker with the ability to supply a crafted XML document to an Apache NiFi instance that uses any of these components can trigger XXE processing [1], [2]. The attacker does not require authenticated access if the NiFi instance is reachable and the flow accepts external XML input. The XXE reference is resolved during document parsing, enabling the attacker to include external entities from attacker-controlled URIs [2].

Impact

Successful exploitation can lead to information disclosure via file inclusion, server-side request forgery (SSRF), or denial of service [1], [2]. The attacker may read arbitrary files on the NiFi server, perform network reconnaissance, or exhaust server resources. The exact impact depends on the permissions of the NiFi process and the network environment [1].

Mitigation

The fix disables Document Type Declarations in the default configuration for the affected Processors and disallows XML External Entity resolution in standard services [2]. Users should upgrade to Apache NiFi 1.16.1 or later, which includes the corrected default behavior [1]. No workaround is required if the default configuration is still in use, as the patch ensures XXE is disabled by default even if the property is not explicitly set.