41 lines
1.6 KiB
YAML
41 lines
1.6 KiB
YAML
id: CVE-2020-13927
|
|
|
|
info:
|
|
name: Airflow Experimental <1.10.11 - REST API Auth Bypass
|
|
author: pdteam
|
|
severity: critical
|
|
description: |
|
|
Airflow's Experimental API prior 1.10.11 allows all API requests without authentication.
|
|
reference:
|
|
- https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E
|
|
- http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html
|
|
- https://airflow.apache.org/docs/1.10.11/security.html#api-authenticatio
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-13927
|
|
remediation: |
|
|
From Airflow 1.10.11 forward, the default has been changed to deny all requests by default. Note - this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide linked in the references.
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2020-13927
|
|
cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
|
|
epss-score: 0.95492
|
|
metadata:
|
|
max-request: 1
|
|
verified: true
|
|
shodan-query: title:"Airflow - DAGs" || http.html:"Apache Airflow"
|
|
tags: packetstorm,cve,cve2020,apache,airflow,unauth,auth-bypass,kev
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- '{{BaseURL}}/api/experimental/latest_runs'
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- '"dag_run_url":'
|
|
- '"dag_id":'
|
|
- '"items":'
|
|
condition: and
|