Jose Rivas

**Name of the Vulnerable Software and Affected Versions** Apache NiFi versions 0.0.1 through 2.9.0 **Description** Apache NiFi allows the construction of qualified URLs using several HTTP request headers that serve as alternatives to the standard Host header without validating the provided values. While a configurable application property was introduced in version 1.6.0 to restrict the HTTP Host header, this validation was not applied to Proxy and Forwarded headers. This lack of validation enables a client to force web services to create invalid qualified URLs for data references or redirection. The issue specifically involves the `X-ProxyHost` and `X-Forwarded-Host` headers. **Recommendations** Update to version 2.10.0. Configure the application with HTTPS to enable header validation via the `nifi.web.proxy.host` property. Ensure reverse proxy servers filter input request headers to provide only allowed values to the application.