PT-2019-8250 · Apache · Apache Airflow

Published 2019-01-23 · Updated 2019-04-19 · CVE-2017-17836

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 1.8.2 and earlier

Description The issue allows an attacker with limited access to Airflow to exfiltrate all credentials from the system. This can occur through various means, such as XSS or by gaining physical access to an unlocked machine. The experimental Airflow feature in question displays authenticated cookies and passwords to databases used by Airflow, thus facilitating the exfiltration of sensitive information.

Recommendations For Apache Airflow versions 1.8.2 and earlier, consider disabling the experimental feature that displays authenticated cookies and database passwords as a temporary workaround until a patch is available. Restrict access to the Airflow system to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

CWE-255

Related Identifiers

CVE-2017-17836

GHSA-9GQG-3FXR-9HV7

PYSEC-2019-149

Affected Products

Apache Airflow

References · 9

• https://osv.dev/vulnerability/CVE-2017-17836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17836 · Security Note
• https://osv.dev/vulnerability/PYSEC-2019-149 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9gqg-3fxr-9hv7 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-149.yaml · Note
• https://github.com/advisories/GHSA-9gqg-3fxr-9hv7 · Note
• https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.org%3E · Note
• https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57@%3Cdev.airflow.apache.org%3E · Note