{"id":"CVE-2023-34468","published":"2023-06-12T15:09:20Z","modified":"2025-02-13T16:55:36Z","title":"Apache NiFi: Potential Code Injection with Database Services using H2","vendor":"Apache Software Foundation","product":"Apache NiFi","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache NiFi","versions":[">= 0.0.2, <= 1.21.0"]}],"description":{"text":"The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.\n\nThe resolution validates the Database URL and rejects H2 JDBC locations.\n\nYou are recommended to upgrade to version 1.22.0 or later which fixes this issue.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache NiFi's DBCPConnectionPool and HikariCPConnectionPool Controller Services contain a code injection flaw in how they handle Database URLs using the H2 driver. An attacker who is an authenticated and authorized user can configure a malicious H2 Database URL that enables execution of custom code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:55Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.61869,"percentile":0.99173,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://nifi.apache.org/security.html#CVE-2023-34468","tags":["release-notes"]},{"url":"https://lists.apache.org/thread/7b82l4f5blmpkfcynf3y6z4x1vqo59h8","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/06/12/3","tags":[]},{"url":"http://packetstormsecurity.com/files/174398/Apache-NiFi-H2-Connection-String-Remote-Code-Execution.html","tags":[]},{"url":"https://www.cyfirma.com/outofband/apache-nifi-cve-2023-34468-rce-vulnerability-analysis-and-exploitation/","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.nifi:nifi-dbcp-base","vulnerableRanges":[">=0.0.2, <1.22.0"],"patched":["1.22.0"],"from":["GHSA-xm2m-2q6h-22jw"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.nifi:nifi-hikari-dbcp-service","vulnerableRanges":[">=0.0.2, <1.22.0"],"patched":["1.22.0"],"from":["GHSA-xm2m-2q6h-22jw"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.nifi:nifi-dbcp-service-nar","vulnerableRanges":[">=0.0.2, <1.22.0"],"patched":["1.22.0"],"from":["GHSA-xm2m-2q6h-22jw"],"provenance":"source"}],"advisories":[{"id":"GHSA-xm2m-2q6h-22jw","url":"https://github.com/advisories/GHSA-xm2m-2q6h-22jw","severity":"HIGH","ecosystem":"Maven","package":"org.apache.nifi:nifi-dbcp-base","vulnerableRanges":[">=0.0.2, <1.22.0"],"patched":["1.22.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xm2m-2q6h-22jw","url":"https://github.com/advisories/GHSA-xm2m-2q6h-22jw","severity":"HIGH","ecosystem":"Maven","package":"org.apache.nifi:nifi-hikari-dbcp-service","vulnerableRanges":[">=0.0.2, <1.22.0"],"patched":["1.22.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-xm2m-2q6h-22jw","url":"https://github.com/advisories/GHSA-xm2m-2q6h-22jw","severity":"HIGH","ecosystem":"Maven","package":"org.apache.nifi:nifi-dbcp-service-nar","vulnerableRanges":[">=0.0.2, <1.22.0"],"patched":["1.22.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-1917","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1917","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":6,"skipped":1,"earliest":"2023-11-25","earliestUrl":"https://github.com/mbadanoiu/CVE-2023-34468","repos":[{"name":"mbadanoiu/CVE-2023-34468","url":"https://github.com/mbadanoiu/CVE-2023-34468","stars":8,"created":"2023-11-25"},{"name":"sbouabid-sec/CVE-2023-34468-POC","url":"https://github.com/sbouabid-sec/CVE-2023-34468-POC","stars":4,"created":"2026-05-10"},{"name":"Jeanpt/CVE-2023-34468","url":"https://github.com/Jeanpt/CVE-2023-34468","stars":1,"created":"2026-05-10"},{"name":"spikeyjr/CVE-2023-34468-PoC","url":"https://github.com/spikeyjr/CVE-2023-34468-PoC","stars":0,"created":"2026-06-16"},{"name":"ozcanpng/CVE-2023-34468","url":"https://github.com/ozcanpng/CVE-2023-34468","stars":0,"created":"2026-07-12"}]},"metasploit":[{"name":"Apache NiFi H2 Connection String Remote Code Execution","module":"exploit/linux/http/apache_nifi_h2_rce","type":"exploit","disclosureDate":"2023-06-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_nifi_h2_rce.rb"}],"first":{"date":"2023-06-12","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_nifi_h2_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/174398/Apache-NiFi-H2-Connection-String-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2023-06-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-34468","provenance":"source"},{"date":"2023-06-12","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-11-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_nifi_h2_rce.rb","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":31.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.83,"detail":"percentile 0.9917"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 6 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-nifi-cve-2023-34212","children":[{"from":"CVE-2023-34468","to":"CVE-2023-36542","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.nifi:nifi-hikari-dbcp-service","fromFixed":"1.22.0","toFixed":"1.23.0","daysApart":47},{"kind":"same-code","provenance":"machine","files":["nifi-nar-bundles/nifi-standard-services/nifi-dbcp-service-bundle/nifi-hikari-dbcp-service/src/main/java/org/apache/nifi/dbcp/HikariCPConnectionPool.java"],"commits":["https://github.com/apache/nifi/commit/4faf3ea59895e7e153db3f8f61147ff70a254361","https://github.com/apache/nifi/commit/532578799c0a4cb1edc54dadda81aa60787e54b0"],"basis":"rarely changed file"}]},{"from":"CVE-2023-34468","to":"CVE-2023-40037","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.nifi:nifi-dbcp-base","fromFixed":"1.22.0","toFixed":"1.23.1","daysApart":67},{"kind":"same-code","provenance":"machine","files":["nifi-nar-bundles/nifi-extension-utils/nifi-dbcp-base/src/main/java/org/apache/nifi/dbcp/utils/DBCPProperties.java","nifi-nar-bundles/nifi-standard-services/nifi-dbcp-service-api/src/main/java/org/apache/nifi/dbcp/ConnectionUrlValidator.java","nifi-nar-bundles/nifi-standard-services/nifi-dbcp-service-bundle/nifi-hikari-dbcp-service/src/main/java/org/apache/nifi/dbcp/HikariCPConnectionPool.java"],"commits":["https://github.com/apache/nifi/commit/4faf3ea59895e7e153db3f8f61147ff70a254361","https://github.com/apache/nifi/commit/064550aacc189f39d7ddd2c0446068adf250f1bf"],"basis":"shared function","functions":["DBCPProperties","HikariCPConnectionPool"]}]}],"packageHistory":[{"cve":"CVE-2023-34468","published":"2023-06-12","fixed":"1.22.0","kev":false},{"cve":"CVE-2023-36542","published":"2023-07-29","fixed":"1.23.0","kev":false}],"package":"Maven:org.apache.nifi:nifi-hikari-dbcp-service"}}