Id_No2015429

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions 2.4.0 through 2.7.0 **Description** The issue is related to the exposure of sensitive information in Apache Airflow, which could allow a remote attacker to obtain confidential information. **Recommendations** For Apache Airflow versions 2.4.0 through 2.7.0, update to a version that contains a fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Drill Provider versions prior to 2.4.3 **Description** The issue is related to improper input validation in Apache Airflow Drill Provider, allowing an attacker to pass malicious parameters when establishing a connection with DrillHook. This gives the attacker an opportunity to read files on the Airflow server. **Recommendations** For versions prior to 2.4.3, it is recommended to upgrade to a version that is not affected. As a temporary workaround, consider restricting access to the DrillHook connection to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Hive Provider versions prior to 6.1.1 **Description** The issue is related to improper input validation, which allows bypassing a security check, potentially leading to remote code execution (RCE) via the `principal` parameter. This can be exploited if an attacker has access to modify connection details. **Recommendations** For versions prior to 6.1.1, update the provider version to 6.1.1 to avoid this issue. As a temporary workaround, consider restricting access to modifying connection details to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow ODBC Provider versions prior to 4.0.0 Apache Airflow MSSQL Provider versions prior to 3.4.1 **Description** The issue is related to insufficient input validation in the Apache Airflow MSSQL Provider and Airflow ODBC Provider modules. This allows a remote attacker to access protected information. The vulnerability is considered low because it requires DAG code to use `get sqlalchemy connection` and someone with access to connection resources to update the connection and exploit it. **Recommendations** For Apache Airflow ODBC Provider versions prior to 4.0.0, upgrade to a version that is not affected. For Apache Airflow MSSQL Provider versions prior to 3.4.1, upgrade to a version that is not affected. As a temporary workaround, consider restricting access to the `get sqlalchemy connection` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Hive Provider versions prior to 5.1.3 **Description** The issue is related to an Improper Input Validation vulnerability in the Apache Airflow Hive Provider. **Recommendations** For versions prior to 5.1.3, update to version 5.1.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 2.5.1 Apache Airflow MySQL Provider versions prior to 4.0.0 **Description** The issue is related to the improper neutralization of special elements used in a command, which can lead to command injection. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Apache Airflow versions prior to 2.5.1, update to version 2.5.1 or later. For Apache Airflow MySQL Provider versions prior to 4.0.0, update to version 4.0.0 or later. As a temporary workaround, consider restricting access to sensitive commands and parameters to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Hive Provider versions prior to 5.0.0 **Description** The issue is related to an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Airflow Hive Provider. This vulnerability allows for command injection, which can lead to unauthorized execution of system commands. **Recommendations** For versions prior to 5.0.0, update to version 5.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive commands and system resources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Pinot Provider versions prior to 4.0.0 Apache Airflow versions prior to 2.3.0 **Description** The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection'. This allows an attacker to control commands executed in the task execution context without needing write access to DAG files. **Recommendations** For Apache Airflow Pinot Provider versions prior to 4.0.0, manually install Pinot Provider version 4.0.0 to resolve the issue. For Apache Airflow versions prior to 2.3.0, update to version 2.3.0 or later and then manually install Pinot Provider version 4.0.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Hive Provider versions prior to 4.1.0 Apache Airflow versions prior to 2.3.0 **Description** The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This allows an attacker to execute arbitrary commands in the task execution context without needing write access to DAG files. **Recommendations** For Apache Airflow Hive Provider versions prior to 4.1.0, manually install Hive Provider version 4.1.0 to resolve the issue. For Apache Airflow versions prior to 2.3.0, update to version 2.3.0 or later and then manually install Hive Provider version 4.1.0 to resolve the issue. For Airflow 2.3.0+ versions with a lower version of the Hive Provider installed, manually install the Hive Provider version 4.1.0 to get rid of the vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Spark Provider versions prior to 4.0.0 Apache Airflow versions prior to 2.3.0 **Description** The issue is related to an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider. This allows an attacker to read arbitrary files in the task execution context without write access to DAG files. **Recommendations** For Apache Airflow Spark Provider versions prior to 4.0.0, manually install Spark Provider version 4.0.0 to resolve the issue. For Apache Airflow versions prior to 2.3.0, update to version 2.3.0 or later and manually install Spark Provider version 4.0.0 to resolve the issue. For Apache Airflow 2.3.0+ versions with a lower version of the Spark Provider installed, manually install Spark Provider version 4.0.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Pig Provider versions prior to 4.0.0 Apache Airflow versions prior to 2.3.0 **Description** The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This allows an attacker to control commands executed in the task execution context without needing write access to DAG files. **Recommendations** For Apache Airflow Pig Provider versions prior to 4.0.0, manually install Pig Provider version 4.0.0 to resolve the issue. For Apache Airflow versions prior to 2.3.0, update to version 2.3.0 or later and then manually install Pig Provider version 4.0.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 2.4.2 **Description** The issue concerns an XSS attack via the `origin` query argument in the "Trigger DAG with config" screen. **Recommendations** For versions prior to 2.4.2, update to version 2.4.2 or later to resolve the issue.