PT-2020-6687 · Apache · Apache Airflow

Junghan Lee · Published 2020-12-21 · Updated 2024-03-06 · CVE-2020-17526

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 1.10.14

Description The issue is related to incorrect session validation in the Apache Airflow web server, caused by the use of a default configuration that includes a pre-set secret key. This allows a malicious user to access an unauthorized Airflow web server on a different site using a session from the original site. The problem arises from the use of a temporary key in the default airflow.cfg configuration file, which is the same for all installations. As a result, a session cookie validated on one Airflow server is also valid for another server.

Recommendations For Apache Airflow versions prior to 1.10.14, change the default value for the [webserver] secret key configuration to prevent unauthorized access. As a temporary workaround, consider restricting access to the Airflow web server until the issue is resolved.

Fix

Improper Authentication

Improper Privilege Management

Using Hardcoded Credentials

Weakness Enumeration

CWE-287

CWE-269

CWE-798

Related Identifiers

BDU:2022-04640

BIT-AIRFLOW-2020-17526

CVE-2020-17526

GHSA-7MX5-X372-XH87

PYSEC-2020-22

Affected Products

Apache Airflow

References · 27

• https://osv.dev/vulnerability/GHSA-7mx5-x372-xh87 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04640 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2020-17526 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/680119 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-17526 · Security Note
• https://osv.dev/vulnerability/CVE-2020-17526 · Vendor Advisory
• https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-22 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/a8900fa5f2b8963e9f57ba4ae5520a5d339aeaad · Note
• https://github.com/apache/airflow/commit/2f3b1c780472afd4c8a93633e6633feb7083792e · Note
• https://github.com/apache/airflow/commit/9e01476a50b9be27c4b1e6c6e24d36f290629195 · Note
• https://github.com/apache/airflow/commit/6b065840323f9a4fc8e372b458d26e419e4fa99b · Note
• https://github.com/apache/airflow/commit/97b2735d65e95c4633966667b6db3908540f3937 · Note
• https://github.com/apache/airflow/commit/fe6d00a54f83468e296777d3b83b65a2ae7169ec · Note