PT-2023-8379 · Apache · Apache Airflow

Andrey Anshin + 1 · Publicado 2023-12-21 · Atualizado 2024-03-06 · CVE-2023-47265

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 2.6.0 through 2.7.3

Description The issue is related to a stored XSS vulnerability that allows a DAG author to add unbounded and not-sanitized JavaScript in the parameter description field of the DAG. This JavaScript can be executed on the client side of any user who looks at the tasks in the browser sandbox, allowing modification of what the user sees in the browser. This opens up possibilities of misleading other users.

Recommendations For Apache Airflow versions 2.6.0 through 2.7.3, upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability. As a temporary workaround, consider restricting access to the parameter description field of the DAG to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2024-00575

BIT-AIRFLOW-2023-47265

CVE-2023-47265

GHSA-PXCH-WR7M-RWXJ

PYSEC-2023-264

Produtos afetados

Apache Airflow

Referências · 19

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/35460 · Correção
• https://github.com/apache/airflow/commit/0b995602e6e5894ee31625a4dd0e6aa255d2a651 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-264.yaml · Nota
• https://osv.dev/vulnerability/CVE-2023-47265 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-00575 · Nota de Segurança
• https://t.me/cvenotify/64643 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1737769338201944240 · Publicação no Twitter
• https://t.me/cvenotify/64627 · Publicação no Telegram
• https://github.com/advisories/GHSA-pxch-wr7m-rwxj · Nota
• http://openwall.com/lists/oss-security/2023/12/21/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-47265 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-264 · Aviso do Fabricante
• https://t.me/cvenotify/65384 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1737796693037388128 · Publicação no Twitter