50 lines
2.1 KiB
YAML
50 lines
2.1 KiB
YAML
id: CVE-2020-13927
|
|
|
|
info:
|
|
name: Airflow Experimental <1.10.11 - REST API Auth Bypass
|
|
author: pdteam
|
|
severity: critical
|
|
description: |
|
|
Airflow's Experimental API prior 1.10.11 allows all API requests without authentication.
|
|
impact: |
|
|
Allows unauthorized access to Airflow Experimental REST API
|
|
remediation: |
|
|
From Airflow 1.10.11 forward, the default has been changed to deny all requests by default. Note - this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide linked in the references.
|
|
reference:
|
|
- https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E
|
|
- http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html
|
|
- https://airflow.apache.org/docs/1.10.11/security.html#api-authenticatio
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-13927
|
|
- http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2020-13927
|
|
cwe-id: CWE-1188
|
|
epss-score: 0.96667
|
|
epss-percentile: 0.99637
|
|
cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: apache
|
|
product: airflow
|
|
shodan-query: title:"Airflow - DAGs" || http.html:"Apache Airflow"
|
|
fofa-query: title="sign in - airflow"
|
|
google-query: intitle:"sign in - airflow"
|
|
tags: cve2020,cve,packetstorm,apache,airflow,unauth,auth-bypass,kev
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- '{{BaseURL}}/api/experimental/latest_runs'
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- '"dag_run_url":'
|
|
- '"dag_id":'
|
|
- '"items":'
|
|
condition: and
|
|
# digest: 4a0a0047304502210089cb49c5ce487c095f5369f8734137a3c3d88fd03971899ea3555491c97381a202206551832746d04cb3b44e1eb98ca8aca17348cd625b1791071c1dfc9b3f801d86:922c64590222798bb761d5b6d8e72950 |