Apache NiFi H2 Connection String Remote Code Execution | allinfosecnews.com

Aug. 30, 2023, 3:12 p.m. |

Packet Storm packetstormsecurity.com

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. This exploit will result in several shells (5-7). Successfully tested against Apache nifi 1.17.0 through 1.21.0.

apache code code execution controller database driver exploit nifi remote code remote code execution result services shells url

More from packetstormsecurity.com / Packet Storm

Packet Storm New Exploits For April, 2024 22 hours ago | packetstormsecurity.com

april archive exploits packet +2

Ubuntu Security Notice USN-6760-1 22 hours ago | packetstormsecurity.com

attacker data denial of service file +11

Kernel Live Patch Security Notice LSN-0103-1 22 hours ago | packetstormsecurity.com

attacker con data expose +20

Microsoft PlayReady Cryptography Weakness 22 hours ago | packetstormsecurity.com

attack beyond cryptography extraction +15

Online Tours And Travels Management System 1.0 SQL Injection 22 hours ago | packetstormsecurity.com

injection management management system sql +6

Qantas App Glitch Sees Boarding Passes Fly To Other Accounts 22 hours ago | packetstormsecurity.com

accounts app data loss flaw +4

Adobe Adds Content Credentials And Firefly To Bug Bounty Program 22 hours ago | packetstormsecurity.com

adobe bounty bug bug bounty +5

Google Boosts Bug Bounty Payouts Tenfold In Mobile App Security Push 22 hours ago | packetstormsecurity.com

app bounty bug bug bounty +6

London Drugs Pharmacy Closes All Stores To Respond To Cyber Incident 22 hours ago | packetstormsecurity.com

britain cyber cyber incident data loss +8

Social Engineer For Reverse Engineering Exploit Study

@ Independent study | Remote

View on infosec-jobs.com

Associate Manager, BPT Infrastructure & Ops (Security Engineer)

@ SC Johnson | PHL - Makati

View on infosec-jobs.com

Cybersecurity Analyst - Project Bound

@ NextEra Energy | Jupiter, FL, US, 33478

View on infosec-jobs.com

Lead Cyber Security Operations Center (SOC) Analyst

@ State Street | Quincy, Massachusetts

View on infosec-jobs.com

Junior Information Security Coordinator (Internship)

@ Garrison Technology | London, Waterloo, England, United Kingdom

View on infosec-jobs.com

Sr. Security Engineer

@ ScienceLogic | Reston, VA

View on infosec-jobs.com