Improper Neutralization of Command Elements in Shell User Group Provider

The optional ShellUserGroupProvider in Apache NiFi versions 1.10.0 through 1.16.2 and Apache NiFi Registry versions 0.6.0 through 1.16.2 does not neutralize arguments for group resolution commands, enabling operating system command injection on Linux and macOS platforms [1][2]. This component is not included in the default configuration, reducing the attack surface for unmodified deployments.

Exploitation requires the ShellUserGroupProvider to be explicitly enabled as one of the User Group Providers in the Authorizers configuration. An attacker must be an authenticated user with elevated privileges: in Apache NiFi, authorization to modify access policies; in Apache NiFi Registry, authorization to read user groups [2]. The vulnerability arises because user-supplied arguments are passed directly to the shell without sanitization, allowing crafted input to execute arbitrary commands.

Successful command injection allows an attacker to execute arbitrary operating system commands on the server, potentially leading to full system compromise, data exfiltration, or lateral movement within the network. The impact is limited to systems where the ShellUserGroupProvider is enabled and the attacker has the required privileges.

The vulnerability is addressed in Apache NiFi 1.16.3 and Apache NiFi Registry 1.16.3 by removing command formatting based on user-provided arguments [1]. Users are advised to upgrade to these versions or, if the ShellUserGroupProvider is not needed, ensure it is not enabled in the Authorizers configuration.