Apache Ranger: Hostname verification bypass in NiFiRegistryClient and NifiClient

Vulnerability

Description

The vulnerability resides in the NiFiRegistryClient and NiFiClient components of Apache Ranger. These clients fail to properly verify TLS hostnames, allowing an attacker to intercept or redirect communications between Ranger and Apache NiFi services. This is a classic hostname verification bypass issue [1][3].

Exploitation

An attacker with network access to the communication path between Ranger and NiFi can perform a man-in-the-middle attack. By presenting a valid certificate for a different hostname, the attacker can decrypt, read, or modify traffic without triggering detection, as the client does not verify that the certificate matches the intended server hostname [3].

Impact

Successful exploitation could lead to unauthorized access to sensitive data managed by Ranger, such as security policies or metadata, and potentially allow the attacker to alter access controls. The impact is considered low severity by the project [3].

Mitigation

Users should upgrade to Apache Ranger version 2.8.0, which corrects the hostname verification logic. No workarounds have been provided for earlier versions [1][3].