PT-2021-22197 · Apache · Apache Airflow

Nathan Jones · Published 2021-09-09 · Updated 2024-03-06 · CVE-2021-38540

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 2.0.0 through 2.1.2

Description The issue concerns the variable import endpoint not being protected by authentication. This allows unauthenticated users to access the endpoint, potentially leading to denial of service, information disclosure, or remote code execution by adding or modifying Airflow variables used in DAGs.

Recommendations For Apache Airflow versions 2.0.0 through 2.1.2, update to version 2.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the variable import endpoint until a patch is available.

Exploit

Fix

DoS

RCE

Missing Authentication

Improper Privilege Management

Weakness Enumeration

CWE-306

CWE-269

Related Identifiers

BIT-AIRFLOW-2021-38540

CVE-2021-38540

GHSA-H88F-R7CW-8FV3

PYSEC-2021-326

Affected Products

Apache Airflow

References · 14

• 🔥 https://github.com/Captain-v-hook/PoC-for-CVE-2021-38540- · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-38540 · Security Note
• https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38540 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2021-38540 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-326 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h88f-r7cw-8fv3 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/bcec1df703cd4a01520a90c3f801cca6f97d9bfd · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2021-326.yaml · Note
• https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2%40%3Cannounce.apache.org%3E · Note
• https://t.me/cibsecurity/28591 · Telegram Post
• https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2@%3Cannounce.apache.org%3E · Note
• https://github.com/advisories/GHSA-h88f-r7cw-8fv3 · Note