Why Is My Kubernetes-Deployed NiFi Auto-Generating Execute Processors with wget and run Commands?

Below is an analysis of your situation based on known NiFi behavior:

---

Likely Cause

NiFi does not natively auto-generate Execute Processors. When you see hundreds of such processors appearing (with commands like wget, run, etc.), it is a strong indicator of unauthorized access via the NiFi REST API. This behavior has been observed when instances aren’t properly secured—especially if they are exposed to external networks. Essentially, an attacker might be using the REST API to deploy processors remotely.

---

Steps to Investigate and Mitigate

1. Review Security Configuration:

   • Ensure that your NiFi instance is secured with proper authentication and authorization (e.g., using TLS, Client Certificates, or LDAP).
   • Verify that the NiFi REST API is not exposed to untrusted networks.

2. Examine Logs:

   • Look at NiFi's application/logs for any unusual access patterns or API calls that match the time these processors were created.
   • Identify IP addresses and correlate with any firewall or access logs. This may help you determine the origin of the unauthorized access.

3. Audit User Access:

   • Confirm that only expected administrator accounts are active.
   • Check if any API tokens or credentials may have been misconfigured or compromised.

4. Upgrade NiFi:

   • NiFi 1.9 is an older version. Consider upgrading to a more recent release, as newer versions contain additional security improvements and patches for known vulnerabilities.
   • Review the release notes for security updates relevant to your deployment.

5. Restrict Network Access:

   • If the NiFi instance does not require public access, consider placing it behind a firewall or VPN.
   • Utilize network-level security controls to restrict access to trusted IPs only.

---

Conclusion

Although I haven’t seen this exact issue in every environment, similar symptoms have been attributed to compromised instances where the REST API was left unsecured. The auto-generated Execute Processors are a red flag indicating a potential breach. I recommend a security audit of your NiFi instance as a priority to prevent further unauthorized actions.

By following these steps, you should be able to narrow down the source of the issue and secure your environment. If needed, consider reaching out to security experts familiar with your network setup for a more in-depth investigation.