Apache Airflow 1.10.10 - (Example Dag) Remote Code Execution Exploit

Exploit Title: Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution Exploit Author: Pepe Berba Vendor Homepage: https://airflow.apache.org/ Software Link: https://airflow.apache.org/docs/apache-airflow/stable/installation.html Version: = 1.10.10 Tested on: Docker apache/airflow:1.10 .10...

Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution

Exploit Title: Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution Date: 2021-06-02 Exploit Author: Pepe Berba Vendor Homepage: https://airflow.apache.org/ Software Link: https://airflow.apache.org/docs/apache-airflow/stable/installation.html Version: = 1.10.10 Tested on: Docker...

Apache Airflow 1.10.10 Remote Code Execution

Exploit Title: Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution Date: 2021-06-02 Exploit Author: Pepe Berba Vendor Homepage: https://airflow.apache.org/ Software Link: https://airflow.apache.org/docs/apache-airflow/stable/installation.html Version: = 1.10.10 Tested on: Docker...

Exploit for OS Command Injection in Apache Airflow

CVE-2020-11978: Remote code execution in Apache Airflow's Exa...

CVE-2021-28359

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions 1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fi...

CVE-2021-28359

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions 1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fi...

aglow (>=0.1.0rc3 <=0.1.0rc4), ai-flow (>=0.1.0 <=0.3.1) +3 more potentially affected by CVE-2021-28359 via apache-airflow (>=2.0.0 <=2.0.0rc3)

apache-airflow PYPI version =2.0.0, =0.1.0rc3, =0.1.0, =0.3.1 - dataverk-airflow =0.3.12 - gps-building-blocks =1.2.2 - neuro-airflow-plugin =0.0.1 Source cves: CVE-2021-28359 Source advisory: OSV:PYSEC-2021-4...

Design/Logic Flaw

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions 1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fi...

CVE-2021-28359 Apache Airflow Reflected XSS via Origin Query Argument in URL

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions 1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fi...

CVE-2021-28359

Technical details for CVE-2021-28359 are not present in the provided documents. Public sources in Connected Documents do not specify affected products/versions or fixes. Monitor for updates.

Apache Airflow 跨站脚本漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A cross-site scripting vulnerability exists in Apache Airflow. The vulnerability...

Authentication bypass in Apache Airflow

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at...

Incorrect Session Validation in Apache Airflow

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have...

GHSA-7MX5-X372-XH87 Incorrect Session Validation in Apache Airflow

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have...

Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944

The origin parameter passed to some of the endpoints like /trigger was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.15. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely...

airflow-clickhouse-plugin (=0.6.0), dataverk-airflow (>=0.3.18 <=0.3.23) +2 more potentially affected by CVE-2020-17515 via apache-airflow (>=2.0.0rc3 <=2.0.2)

apache-airflow PYPI version =2.0.0rc3, =0.3.18, =11.8.0, =13.7.0 - neuro-airflow-plugin =0.0.1 Source cves: CVE-2020-17515 Source advisory: OSV:GHSA-86VP-X3PR-79RX...

GHSA-86VP-X3PR-79RX Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944

The origin parameter passed to some of the endpoints like /trigger was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.15. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely...

Privilege Escalation

apacheairflow is vulnerable to privilege escalation. Users with Viewer or User role are able to access sensitive information as it does not enforce a proper access control on Configurations Endpoint for the Stable API even if webserver exposeconfig is set to False in airflow.cfg...

aglow (>=0.1.0rc3 <=0.1.0rc4), ai-flow (>=0.1.0 <=0.3.1) +3 more potentially affected by CVE-2021-26559 via apache-airflow (>=2.0.0 <=2.0.0rc3)

apache-airflow PYPI version =2.0.0, =0.1.0rc3, =0.1.0, =0.3.1 - dataverk-airflow =0.3.12 - gps-building-blocks =1.2.2 - neuro-airflow-plugin =0.0.1 Source cves: CVE-2021-26559 Source advisory: OSV:GHSA-FFW3-6MP6-JMVJ...

GHSA-FFW3-6MP6-JMVJ Improper Access Control in Apache Airflow

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when webserver exposeconfig is set to False in airflow.cfg. This allowed a privilege escalation attack...