Threats affecting pkg:maven/Apache Software Foundation/org.apache.nifi:nifi-web-api

Apache NiFi versions 2.9.0 through 2.11.0 have a missing authorization vulnerability in the Connector configuration update and verification REST API methods. These methods do not properly enforce authorization checks on Assets and Secrets referenced in the configuration, allowing authenticated users with write privileges on a Connector to apply Secret values from Parameter Providers they are not authorized to read. Additionally, Asset identifiers are accepted without verifying ownership by the Connector. This issue is mitigated by upgrading to Apache NiFi 2.12.0, which enforces read access checks on Parameter Providers and verifies Asset ownership during configuration updates.

Apache NiFi versions 1.5.0 through 2.11.0 have a missing authorization vulnerability in REST API methods that replace the entire contents of a Process Group. Authenticated users with write access to a Process Group could modify or remove components in descendant Process Groups without proper authorization. This issue affects deployments using component-level authorization policies and is limited by existing checks to stopped components. Upgrading to Apache NiFi 2.12.0 addresses this inconsistency in authorization enforcement.

Apache NiFi 2.11.0 contains a missing authorization vulnerability in its REST API methods for migrating version-controlled Process Groups into Connectors. The vulnerability allows authenticated users with read or write access to a Connector to access or migrate Process Groups without proper authorization checks on those Process Groups. This can lead to unauthorized enumeration of Process Group details or migration of Process Groups without write access. The vulnerability is mitigated in Apache NiFi 2.12.0 by enforcing authorization checks on the source Process Groups during migration requests.

Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not check restricted status when handling requests to replace Process Groups. The missing authorization permits a user with general write access to add components with Restricted status. Apache NiFi installations that do not implement specific authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation, which removes the implementation of Restricted status authorization from the framework.

Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined verification methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying component configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, requiring write access to submit configuration verification requests.