# CVE-2023-34468: Apache NiFi: Potential Code Injection with Database Services using H2

- Exploited (CISA KEV): no
- Published: 2023-06-12
- CVSS: 8.8 HIGH (v3.1)
- EPSS: 61.9% (99th percentile)
- CWE: CWE-94

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2023-12-12 | 183 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2023-12-12 · new · rule 200103330
  > Added: signature 200103330 "Apache NiFi H2 Connection String Remote Code Execution" (Command Execution, risk High), systems: Various systems. References: CVE-2023-34468.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2023-34468 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2023-34468