Apache NiFi RCE

What is Apache NiFi?
The NiFi API is used to create, configure and run a command using the ExecuteProcess processor and then the processor is stopped and deleted.

vulnerability explanation : An exploits a weak configuration in Apache NiFi that can lead to remote command execution. NiFi includes a number of processors by deafault, including the ExecuteProcess processor that can be used to run system commands. There are other "dangerous" processors, such as ExecuteScript, but they require those scripting languages to be installed on the systems being exploited, and the processors are marked as "Experimental". ExecuteProcess was chosen because it is not experimental and doesn't rely on anything else being installed.

The API must be unsecured (or credentials/token provided) and the ExecuteProcess processor must be available. The default installation of NiFi is unsecured and runs over HTTP. It is possible to secure it and run over HTTPS, but the authentication must take place using an external provider, such as LDAP or Kerberos. If authentication is enabled, it is possible to restrict access for an authenticated user such that processors cannot be created, or even to allow processors, but not allows "unsafe" processors (e.g. ExecuteProcess) to be created.

Vulnmachines​​ - Place for Pentesters
Vulnmachines is online cyber security training platform with a massive number of labs, allowing individuals, students, cyber professionals, companies, universities and all kinds of organizations around the world to enhance their practical skills with Real-world enterprise scenarios.

TheSecOps Group : The SecOps Group is founded by industry veterans. We have over 15 years of experience in providing cyber security consultancy and have worked with some of the largest blue chip companies. Being an independent boutique company, we enable our customers to continuously identify and assess their security postures and provide advice in securing against the adversaries.

Our team regularly speaks at international conferences (including Black Hat, Defcon, HITB, and OWASP Appsec). We pride ourselves in hiring the best talent and our passion is to stay up-to-date with the latest in the world of ethical hacking.

Follow us

#infosec #cybersecurity #cyber #pentesting #cve #exploit #django #pentest #bugbounty #bugbountytips #vulnerability #information #owasptop10
what is nifi
apache nifi
apache nifi vulnerability
apache nifi exploit
Remote code execution vulnerability

#apache #nifi #cybersecurity #infosec #bugbounty #cvepoc

[coldplay]

I see you can execute commands but how can you see the response if you don’t have access to the NiFi host terminal?