PT-2024-4769 · Apache · Apache Airflow

Seokchan Yoon + 1 · Published 2024-07-17 · Updated 2025-07-28 · CVE-2024-39877

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 2.4.0 through 2.9.3

Description This vulnerability allows authenticated DAG authors to craft a malicious doc md parameter, potentially leading to arbitrary code execution within the scheduler context. This bypasses Airflow’s security model, which should prevent such actions. The vulnerability stems from a lack of sanitization when processing the doc md parameter, which is used to create descriptions for DAGs (Directed Acyclic Graphs) in the Airflow web interface. When doc md does not have a '.md' extension, Airflow creates a template using jinja2.Template(doc md), resulting in a Server-Side Template Injection (SSTI) condition. Attackers can leverage Python’s introspection capabilities to enumerate classes and execute commands, potentially compromising the system. Exploitation requires the ability to create DAGs on the Airflow server.

Recommendations Upgrade to Apache Airflow version 2.9.3 or later to resolve this issue.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-277

Related Identifiers

BDU:2024-05292

BIT-AIRFLOW-2024-39877

CVE-2024-39877

GHSA-G5HV-R743-V8PM

PYSEC-2024-190

Affected Products

Apache Airflow

References · 27

• https://github.com/apache/airflow/pull/40522 · Patch
• https://osv.dev/vulnerability/GHSA-g5hv-r743-v8pm · Vendor Advisory
• https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-190 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05292 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39877 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2024-39877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39877 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/8159f6e24704f5e0e3b3217cf79ecf5083dce531 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-190.yaml · Note
• https://t.me/cvedetector/1066 · Telegram Post
• https://t.me/pentestingnews/49205 · Telegram Post
• https://t.me/cybersecuritytechnologies/10944 · Telegram Post
• https://t.me/cvenotify/86772 · Telegram Post