CVE-2023-34468

This repository provides a writeup and references for CVE-2023-34468, an RCE vulnerability in Apache NiFi's DBCPConnectionPool and HikariCPConnectionPool due to improper validation of H2 database URLs. It includes links to a detailed PDF, Metasploit module, and related resources.

This repository contains a functional exploit for CVE-2023-34468, targeting Apache NiFi versions 0.0.2 through 1.21.0. The exploit leverages the H2 database driver's JavaScript execution capability within JDBC connection strings to achieve remote code execution via a series of NiFi REST API calls.

This repository contains a functional exploit for CVE-2023-34468, targeting Apache NiFi 1.21.0. The exploit leverages a DBCPConnectionPool controller service and an ExecuteSQL processor to achieve remote code execution via a crafted SQL payload delivered over HTTP.

This repository contains a functional Python exploit for CVE-2023-34468, targeting Apache NiFi versions 0.0.2 through 1.21.0. The exploit leverages H2 database connection string manipulation to achieve remote code execution via embedded JavaScript triggers.

This repository contains a functional exploit for CVE-2023-34468, targeting Apache NiFi 1.21.0. The exploit leverages a DBCPConnectionPool controller service and an ExecuteSQL processor to achieve remote code execution via a crafted SQL payload delivered over HTTP.

This repository appears to be a legitimate Apache NiFi project README with no exploit code. It contains documentation and setup instructions for Apache NiFi, not a PoC for CVE-2023-34468.

This Metasploit module exploits CVE-2023-34468 in Apache NiFi by leveraging the H2 database driver's JavaScript trigger functionality to execute arbitrary commands via a crafted JDBC connection string. It requires authentication and targets versions 0.0.2 through 1.21.0.