CVE-2025-66524: Apache NiFi RCE Vulnerability

CVE-2025-66524 Overview

CVE-2025-66524 is an insecure deserialization vulnerability [CWE-502] affecting Apache NiFi versions 1.20.0 through 2.6.0. The flaw resides in the GetAsanaObject Processor, which uses generic Java object serialization and deserialization without filtering when interacting with a configured Distribute Map Cache Client Service. An attacker with direct access to the cache server can store crafted serialized objects that trigger arbitrary code execution when the processor reads state information. Apache resolved the issue in NiFi 2.7.0 by replacing Java object serialization with JSON serialization.

Critical Impact
Successful exploitation allows arbitrary Java code execution within the Apache NiFi process, leading to full compromise of confidentiality, integrity, and availability on the NiFi host.

Affected Products

Apache NiFi 1.20.0 through 2.6.0
Apache NiFi 2.7.0 release candidates (2.7.0:rc1, 2.7.0:rc2)
Deployments using the nifi-asana-processors-nar bundle with GetAsanaObject

Discovery Timeline

2025-12-19 - CVE-2025-66524 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66524

Vulnerability Analysis

The GetAsanaObject Processor in Apache NiFi persists state information through a configurable Distribute Map Cache Client Service. The processor serializes state objects using standard Java ObjectOutputStream and reads them back with ObjectInputStream without applying a deserialization filter. An attacker who can write entries into the cache server controls the byte stream that NiFi later deserializes. Crafted gadget chains drawn from libraries already on the NiFi classpath enable arbitrary code execution under the NiFi service account.

Root Cause

The root cause is unfiltered Java object deserialization [CWE-502]. The processor trusts the cache server as a state store and assumes the serialized bytes originated from itself. No allow-list of classes, no ObjectInputFilter, and no integrity check guards the deserialization path. Any modification of the cache contents bypasses NiFi's authentication and authorization boundaries because the processor consumes the data internally.

Attack Vector

Exploitation requires two conditions. First, the target NiFi instance must run the GetAsanaObject Processor. Second, the attacker must reach the configured cache server directly, typically on a network segment shared with NiFi. The attacker writes a malicious serialized payload to the cache entry that GetAsanaObject polls. When the processor retrieves and deserializes the entry, the gadget chain executes within the NiFi JVM. The attack vector is network-based but requires high privileges on the cache infrastructure, which is reflected in the elevated attack complexity. See the Apache Mailing List Thread and the OpenWall OSS-Security Post for advisory details.

Detection Methods for CVE-2025-66524

Indicators of Compromise

Unexpected child processes spawned by the NiFi JVM, particularly shell interpreters such as sh, bash, or cmd.exe.
Outbound network connections from the NiFi host to attacker-controlled infrastructure shortly after GetAsanaObject execution cycles.
Anomalous entries in the configured Distribute Map Cache that contain Java serialization magic bytes (AC ED 00 05).

Detection Strategies

Inventory all NiFi flows for the presence of GetAsanaObject processors within the nifi-asana-processors-nar bundle.
Monitor NiFi nifi-app.log for deserialization exceptions or stack traces referencing ObjectInputStream and Asana processor classes.
Inspect cache server traffic for clients other than the NiFi node writing to the GetAsanaObject state key.

Monitoring Recommendations

Enable process-level telemetry on NiFi hosts to capture child process creation and command-line arguments.
Alert on new listening ports or reverse shell patterns originating from the NiFi service account.
Forward NiFi audit logs and cache server access logs to a centralized analytics platform for correlation.

How to Mitigate CVE-2025-66524

Immediate Actions Required

Upgrade to Apache NiFi 2.7.0, which replaces Java object serialization with JSON serialization in the GetAsanaObject Processor.
If upgrading is not immediately possible, remove the nifi-asana-processors-nar bundle from the NiFi lib directory to eliminate the vulnerable processor.
Restrict network access to the Distribute Map Cache server so that only authorized NiFi nodes can read or write entries.

Patch Information

Apache NiFi 2.7.0 is the fixed release. The patch removes generic Java ObjectOutputStream/ObjectInputStream usage from GetAsanaObject and substitutes a JSON-based state encoding that is not susceptible to gadget-chain deserialization attacks. Refer to the Apache Mailing List Thread for the official advisory.

Workarounds

Delete the GetAsanaObject Processor from active flows and remove the nifi-asana-processors-nar archive from $NIFI_HOME/lib.
Place the Distribute Map Cache server behind a firewall or private subnet accessible only to NiFi nodes.
Require mutual TLS authentication on the Distribute Map Cache Client Service to prevent unauthorized writes.

bash

# Remove the vulnerable Asana processors bundle prior to NiFi restart
cd $NIFI_HOME/lib
ls nifi-asana-processors-nar-*.nar
rm nifi-asana-processors-nar-*.nar
$NIFI_HOME/bin/nifi.sh restart