CVE-2022-33140: 
Java vulnerability analysis and mitigation

Apache NiFi and Apache NiFi Registry versions 1.10.0 to 1.16.2 contained a vulnerability in the optional ShellUserGroupProvider component that allowed command injection on Linux and macOS platforms. The vulnerability was identified as CVE-2022-33140 and was disclosed on June 15, 2022. The issue affected the user group resolution functionality in both NiFi and NiFi Registry applications (NVD).

The vulnerability was classified as CWE-78 (OS Command Injection) and involved improper neutralization of command elements in the ShellUserGroupProvider component. The issue allowed injection of operating system commands through user group resolution commands. The ShellUserGroupProvider was not included in the default configuration, requiring explicit enablement in the Authorizers configuration (NVD, Apache NiFi).

The vulnerability could allow authenticated users with specific privileges to execute arbitrary operating system commands. For Apache NiFi, this required authorization to modify access policies, while for Apache NiFi Registry, it required authorization to read user groups (Apache NiFi).

The vulnerability was fixed in Apache NiFi and NiFi Registry version 1.16.3 by completely removing the shell commands from the ShellUserGroupProvider that received user arguments. Users running affected versions should upgrade to version 1.16.3 or later (Apache NiFi).