Executive Summary

This vulnerability exists in Apache NiFi versions 0.0.1 through 2.9.0, where the software builds qualified URLs from several HTTP request headers that serve as alternatives to the standard Host header without properly validating their values.

Although Apache NiFi 1.6.0 introduced a configurable property to restrict values in the HTTP Host header, it did not apply similar validation to alternative headers such as Proxy and Forwarded headers.

Because of this lack of validation, a client can send crafted HTTP headers that cause Apache NiFi web services to construct invalid or malicious URLs for redirection or data references.

The recommended mitigation is to upgrade to Apache NiFi 2.10.0, which implements validation for the X-ProxyHost and X-Forwarded-Host headers based on the nifi.web.proxy.host property and requires HTTPS configuration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to manipulate the URLs constructed by Apache NiFi web services, potentially leading to redirection to malicious sites or incorrect data references.

Such manipulation could be exploited to conduct phishing attacks, redirect users to harmful content, or interfere with data integrity by referencing invalid or malicious URLs.

The impact includes potential loss of trust, data exposure, or disruption of service depending on how the URLs are used within the application or by its users.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended mitigation is to upgrade Apache NiFi to version 2.10.0, which implements validation for the X-ProxyHost and X-Forwarded-Host HTTP request headers based on the nifi.web.proxy.host property.

Enabling header validation requires configuring the application to use HTTPS.

Additionally, reverse proxy servers in front of Apache NiFi should be configured to filter input request headers and provide only allowed values to the application.

Useful 0 Not Useful 0