PT-2023-4749 · Apache · Apache Airflow Spark Provider

Happyhacking-K · Published 2023-08-25 · Updated 2023-09-08 · CVE-2023-40195

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Airflow Spark Provider versions prior to 4.1.3

Description The issue is related to deserialization of untrusted data and inclusion of functionality from an untrusted control sphere. When the Apache Spark provider is installed on an Airflow deployment, an authorized Airflow user can run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Administrators may have provided authorizations to configure Spark hooks without considering this risk, as it was not explicitly mentioned in the documentation prior to version 4.1.3.

Recommendations To resolve the issue, administrators should review their configurations to ensure that authorization to configure Spark hooks is only provided to fully trusted users. For versions prior to 4.1.3, consider restricting access to the Spark hooks configuration to minimize the risk of exploitation until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-829

CWE-502

Related Identifiers

BDU:2023-05183

CVE-2023-40195

GHSA-8Q28-PW9G-W82C

PYSEC-2023-156

Affected Products

Apache Airflow Spark Provider

References · 18

• https://github.com/apache/airflow/pull/33233 · Patch
• https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40195 · Security Note
• https://bdu.fstec.ru/vul/2023-05183 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40195 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-156 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8q28-pw9g-w82c · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/6850b5c777fa515e110ad1daa85242209a8ec6c0 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-apache-spark/PYSEC-2023-156.yaml · Note
• https://twitter.com/CVEnew/status/1696075143561326718 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1696108942944813356 · Twitter Post
• https://t.me/cvenotify/57437 · Telegram Post
• https://t.me/cibsecurity/69273 · Telegram Post
• https://twitter.com/h1Disclosed/status/1700147117245829526 · Twitter Post