PT-2023-8378 · Apache · Apache Airflow

Balis0Ng + 1 · Published 2023-12-21 · Updated 2024-03-06 · CVE-2023-48291

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.8.0

Description The issue allows an authenticated user with limited access to some DAGs to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus enabling the user to clear DAGs they shouldn't. This is related to a missing fix in Apache Airflow 2.7.2. The vulnerability is also associated with information disclosure in the error data area, which could allow a remote attacker to gain unauthorized access to the database.

Recommendations For Apache Airflow versions prior to 2.8.0, upgrade to version 2.8.0 or newer to mitigate the risk associated with this issue. As a temporary workaround, consider restricting access to sensitive DAG resources until the upgrade is applied. Additionally, monitor user activity and access logs to detect any potential exploitation attempts.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2024-00574

BIT-AIRFLOW-2023-48291

CVE-2023-48291

GHSA-8F57-WCMG-4JMH

PYSEC-2023-265

Affected Products

Apache Airflow

References · 18

• https://github.com/apache/airflow/pull/34366 · Patch
• https://lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2023-48291 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8f57-wcmg-4jmh · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-265 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00574 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48291 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/4f1b500c47813c54349b7d3e48df0a444fb4826c · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-265.yaml · Note
• http://openwall.com/lists/oss-security/2023/12/21/1 · Note
• https://twitter.com/oss_security/status/1737865787564523791 · Twitter Post
• https://twitter.com/CVEnew/status/1737772976030786019 · Twitter Post
• https://t.me/cvenotify/64628 · Telegram Post