XML External Entity Reference in Apache NiFi
Date: 2023-02
Affected: maven/org.apache.nifi:nifi-ccda-processors
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2017-12623
CVE-2018-1309
CVE-2021-44145
CVE-2022-29265
CVE-2022-33140
CVE-2023-22832
CWE: CWE-200
CWE-611
CWE-74
CWE-78
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.


Mitigations:

Architectural layers (MAESTRO):