title: MiNiFi CPP arbitrary script execution is possible on the agent's host machine through the c2 protocol
description: From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command is then executed using the same privileges as the application binary. This was addressed in version 0.10.0
problem types: CWE-78 OS Command Injection
affected:
{
product: Apache NiFi - MiNiFi C++
vendor: Apache Software Foundation
versions:
changes: [at: 0.10.0, status: unaffected], lessThan: Apache NiFi - MiNiFi C++*, status: affected, version: 0.5.0, versionType: custom
}