PT-2021-17037 · Apache · Apache Airflow

Ian Carroll · Published 2021-02-17 · Updated 2024-03-06 · CVE-2021-26559

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow version 2.0.0

Description The issue is related to Improper Access Control on the Configurations Endpoint for the Stable API of Apache Airflow. This allows users with Viewer or User role to obtain Airflow Configurations, including sensitive information, even when the [webserver] expose config is set to False in airflow.cfg. This vulnerability enabled a privilege escalation attack.

Recommendations For Apache Airflow version 2.0.0, consider restricting access to the Configurations Endpoint to prevent unauthorized users from obtaining sensitive information until a patch is available. As a temporary workaround, review and adjust the [webserver] expose config setting in airflow.cfg to ensure it is properly configured to restrict access to sensitive configurations.

Fix

Improper Privilege Management

Improper Access Control

Weakness Enumeration

CWE-269

CWE-284

Related Identifiers

BIT-AIRFLOW-2021-26559

CVE-2021-26559

GHSA-FFW3-6MP6-JMVJ

PYSEC-2021-2

Affected Products

Apache Airflow

References · 17

• https://osv.dev/vulnerability/CVE-2021-26559 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-2 · Vendor Advisory
• https://lists.apache.org/thread.html/r3b3787700279ec361308cbefb7c2cce2acb26891a12ce864e4a13c8d%40%3Cusers.airflow.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ffw3-6mp6-jmvj · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2021-26559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26559 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/3909232fafd09ac72b49010ecdfd6ea48f06d5cf · Note
• https://github.com/apache/airflow/commit/5e35926c7eda0dfa11a9623e4bf5f60c2bd6b3f6 · Note
• https://github.com/apache/airflow/blob/486b76438c0679682cf98cb88ed39c4b161cbcc8/CHANGELOG.txt · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2021-2.yaml · Note
• https://t.me/cibsecurity/23740 · Telegram Post
• http://openwall.com/lists/oss-security/2021/02/17/1 · Note
• https://lists.apache.org/thread.html/rd142565996d7ee847b9c14b8a9921dcf80bc6bc160e3d9dca6dfc2f8@%3Cannounce.apache.org%3E · Note
• https://t.me/cvenotify/10359 · Telegram Post