Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-34212 — CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi | Kitploit
Tools/GitHubGitHub/mbadanoiu/cve-2023-34212
Vulnerability AnalysisCode AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHubmbadanoiu/cve-2023-34212

CVE-2023-34212

CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi

View Repository
3212 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2023-34212: Java Deserialization via JNDI Components in Apache NiFi

The JndiJmsConnectionFactoryProvider Controller Service along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.

Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found here.

Requirements:

This vulnerability requires:

  • Valid user credentials

Proof Of Concept:

More details and the exploitation process can be found in this PDF.

Additional Resources:

Kudos to Veraxy00 of Qianxin TI Center for discovering and reporting the vulnerability in the same time period as me.

CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi can be used to bypass security measures implemented for CVE-2023-34212 resulting in RCE for versions of Apache NiFi <= 1.23.0.

Download Tool