BIT-airflow-2024-39877: Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

Q: Who can exploit this issue?

An authenticated user who can author DAGs can exploit it by crafting the doc_md parameter. The issue allows that DAG author’s code to execute in the scheduler context.

Q: Which Airflow versions are affected?

Apache Airflow 2.4.0 and versions before 2.9.3 are affected. Upgrading to version 2.9.3 or later removes the vulnerability.

Published Jul 17, 2024

Updated

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

Affected Software

1 affected component

Apache Airflow>=2.4.0<2.9.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Airflow to a version that resolves this vulnerability.
Fixed in 2.9.3

Event History

Jul 17, 2024

CVE Published

via OSV·07:54 AM

Data Sourced

via OSV·07:54 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user who can author DAGs can exploit it by crafting the doc_md parameter. The issue allows that DAG author’s code to execute in the scheduler context.

Which Airflow versions are affected?

Apache Airflow 2.4.0 and versions before 2.9.3 are affected. Upgrading to version 2.9.3 or later removes the vulnerability.

BIT-airflow-2024-39877: Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which Airflow versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which Airflow versions are affected?