Apache NiFi MongoDB Credential Exposure in Provenance Events Vulnerability

A vulnerability in Apache NiFi versions 1.13.0 through 2.2.0 allows for the inclusion of MongoDB authentication credentials in provenance event records generated by MongoDB components. This issue enables authorized users with read access to these provenance events to view the exposed usernames and passwords. The vulnerability arises from the improper handling of authentication details in provenance records, which can be accessed during the processing of MongoDB-related tasks.

Impact

The vulnerability could lead to unauthorized exposure of MongoDB usernames and passwords, potentially allowing for unauthorized access to MongoDB databases or operations.

Remediation

Users are advised to upgrade to Apache NiFi version 2.3.0, which removes MongoDB credentials from provenance event records.