Package Instance

Deserialization of Untrusted Data
Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack.

Improper Input Validation
The `X-Frame-Options` headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks.

Cross-site Scripting
There are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient.

Improper Input Validation
A malicious `X-ProxyContextPath` or `X-Forwarded-Context` header containing external resources or embedded code could cause remote code execution.

Improper Restriction of XML External Entity Reference
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity.

Origin Validation Error
Apache NiFi needs to establish the response header telling browsers to only allow framing with the same origin.

Cross-site Scripting
The error page reflects the value of the HTTP request header `X-ProxyContextPath` without sanitization, resulting in a XSS attack.

Cross-Site Request Forgery (CSRF)
The template upload API endpoint accepts requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack.