PT-2024-31664 · Apache · Apache Airflow

Amogh Desai + 2 · Published 2024-09-06 · Updated 2024-12-07 · CVE-2024-45498

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache Airflow version 2.10.0

Description: The issue allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. This is related to the example DAG example inlet event extra.py shipped with Apache Airflow. It is recommended to review DAGs based on this example and to avoid exposing example DAGs in deployments.

Recommendations: For Apache Airflow version 2.10.0, upgrade to version 2.10.1 or later to resolve the issue. If you must expose the example DAGs, consider upgrading as the primary mitigation measure. As a temporary workaround, consider restricting access to the example DAGs until the issue is resolved.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BIT-AIRFLOW-2024-45498

CVE-2024-45498

GHSA-C392-WHPC-VFPR

PYSEC-2024-266

Affected Products

Apache Airflow

References · 17

• https://github.com/apache/airflow/pull/41873 · Patch
• https://osv.dev/vulnerability/BIT-airflow-2024-45498 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45498 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-266 · Vendor Advisory
• https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c392-whpc-vfpr · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/09ec2616568f8a18e0d5fe408110fae06ddf748f · Note
• http://openwall.com/lists/oss-security/2024/09/06/2 · Note
• https://openwall.com/lists/oss-security/2024/09/06/2 · Note
• https://twitter.com/oss_security/status/1832170016982364372 · Twitter Post
• https://twitter.com/CVEnew/status/1832332463386902792 · Twitter Post
• https://twitter.com/bountywriteups/status/1865236872638681240 · Twitter Post
• https://t.me/cvedetector/5012 · Telegram Post