PT-2023-4782 · Apache · Apache Airflow

H1_Yusuf + 4 · Publicado 2023-08-23 · Atualizado 2025-01-08 · CVE-2023-40273

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.0

Description The issue is related to a session fixation vulnerability in the Airflow web interface, allowing an authenticated user to continue accessing the webserver even after their password has been reset by an admin. This vulnerability can be exploited by a remote attacker to hijack a user's session. When using the database session backend, existing sessions of the user are invalidated when the password is reset. However, when using the securecookie session backend, sessions are not invalidated and require changing the secure key and restarting the webserver. Users resetting their passwords are informed about this with a flash message warning in the UI.

Recommendations Upgrade to Apache Airflow version 2.7.0 or newer to mitigate the risk associated with this issue. As a temporary workaround, consider manually cleaning the session database for the database session backend or changing the secure key and restarting the webserver for the securecookie session backend.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

BDU:2023-05229

BIT-AIRFLOW-2023-40273

CVE-2023-40273

GHSA-PM87-24WQ-R8W9

PYSEC-2023-158

Produtos afetados

Apache Airflow

Referências · 20

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/33347 · Correção
• https://github.com/apache/airflow/commit/f5d8201ea7935d17cecaf25fc90d4ef0ccdd627b · Nota
• https://github.com/apache/airflow/commit/2caa186935151683076b74357daad83d2538a3f6 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-158.yaml · Nota
• https://twitter.com/h1Disclosed/status/1698546562010660912 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-40273 · Aviso do Fabricante
• https://t.me/cibsecurity/69072 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-40273 · Nota de Segurança
• https://lists.apache.org/thread/9rdmv8ln4y4ncbyrlmjrsj903x4l80nj · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2023/08/23/1 · Nota
• https://osv.dev/vulnerability/PYSEC-2023-158 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-pm87-24wq-r8w9 · Aviso do Fabricante
• https://t.me/cvenotify/106738 · Publicação no Telegram
• https://t.me/cvenotify/96442 · Publicação no Telegram