CVE-2023-34468: Apache NiFi: Potential Code Injection with Database Services using H2

[David Handermann <exceptionfactory () apache org>]

Severity: important

Affected versions:

- Apache NiFi 0.0.2 through 1.21.0

Description:

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an 
authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

This issue is being tracked as NIFI-11653 

Credit:

Matei "Mal" Badanoiu (finder)

References:

https://nifi.apache.org/security.html#CVE-2023-34468
https://nifi.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-34468
https://issues.apache.org/jira/browse/NIFI-11653

Timeline:

2023-06-06: reported
2023-06-06: confirmed
2023-06-06: resolved