CVE-2022-33140

The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellUserGroupProvider to be one of the enabled User Group Providers in the Authorizers configuration. Command injection also requires an authenticated user with elevated privileges. Apache NiFi requires an authenticated user with authorization to modify access policies in order to execute the command. Apache NiFi Registry requires an authenticated user with authorization to read user groups in order to execute the command. The resolution removes command formatting based on user-provided arguments.

• CWE-78
• CWE-78

• https://lists.apache.org/thread/bzs2pcdjsdrh5039oslmfr9mbs9qqdhrMailing List, Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2022-33140Issue Tracking, Vendor Advisory
• https://lists.apache.org/thread/bzs2pcdjsdrh5039oslmfr9mbs9qqdhrMailing List, Vendor Advisory
• https://nifi.apache.org/security.html#CVE-2022-33140Issue Tracking, Vendor Advisory

Published

Jun 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-33128RG-EG series gateway EG350 EG_RGOS 11.1(6) was discovered to…9.1
• CVE-2022-3313Incorrect security UI in full screen in Google Chrome prior …6.5
• CVE-2022-33137A vulnerability has been identified in SIMATIC MV540 H (All …8
• CVE-2022-33138A vulnerability has been identified in SIMATIC MV540 H (All …7.5
• CVE-2022-33139A vulnerability has been identified in Cerberus DMS (All ver…9.8
• CVE-2022-3314Use after free in logging in Google Chrome prior to 106.0.52…6.5
• CVE-2022-33141Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-33142Authenticated (subscriber+) Denial Of Service (DoS) vulnerab…6.5
• CVE-2022-33143Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-33144Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-33145Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-33146Open redirect vulnerability in web2py versions prior to 2.22…6.1