PT-2020-6688 · Redis+2 · Redis+2

Adam Goldschmit · Published 2020-07-13 · Updated 2024-03-06 · CVE-2020-11981

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 1.10.10 and below

Description The issue allows an attacker to inject commands if they can connect directly to the broker, such as Redis or RabbitMQ, when using CeleryExecutor. This can result in the celery worker running arbitrary commands. The vulnerability is related to the lack of protection measures for the web page structure, which can be exploited by a remote attacker to execute arbitrary commands.

Recommendations For Apache Airflow versions 1.10.10 and below, consider disabling the CeleryExecutor until a patch is available to prevent command injection. Restrict access to the broker, such as Redis or RabbitMQ, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-04643

BIT-AIRFLOW-2020-11981

CVE-2020-11981

GHSA-976R-QFJJ-C24W

PYSEC-2020-15

Affected Products

Apache Airflow

Rabbitmq

Redis

References · 15

• https://osv.dev/vulnerability/CVE-2020-11981 · Vendor Advisory
• https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-976r-qfjj-c24w · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2020-11981 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/680119 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-15 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04643 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-11981 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/1dda6fdde7c6bcaf0d6534786beeeba868006dd2 · Note
• https://github.com/apache/airflow/commit/afa4b11fddfdbadb048f742cf66d5c21c675a5c8 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-15.yaml · Note
• https://lists.apache.org/thread/cn57zwylxsnzjyjztwqxpmly0x9q5ljx · Note
• https://github.com/advisories/GHSA-976r-qfjj-c24w · Note
• https://web.archive.org/web/20220427031325/https://issues.apache.org/jira/browse/AIRFLOW-6351 · Note