PYSEC-2024-190: Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

Q: What level of access does an attacker need to exploit this issue?

The attacker must be an authenticated DAG author. They can craft the doc_md parameter so that arbitrary code executes in the airflow-scheduler context.

Q: Which Airflow versions are affected?

Apache Airflow 2.4.0 and versions before 2.9.3 are affected. Upgrade to version 2.9.3 or later.

Q: What is the impact if exploitation succeeds?

Successful exploitation can result in arbitrary code execution in the scheduler context. The reported impact includes high confidentiality, integrity, and availability consequences.

Published Jul 17, 2024

Updated

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

Affected Software

1 affected component

Apache Airflow=2.4.0, <2.9.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Airflow to a version that resolves this vulnerability.
Fixed in 2.9.3

Event History

Jul 17, 2024

CVE Published

via OSV·07:54 AM

Data Sourced

via OSV·07:54 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must be an authenticated DAG author. They can craft the doc_md parameter so that arbitrary code executes in the airflow-scheduler context.

Which Airflow versions are affected?

Apache Airflow 2.4.0 and versions before 2.9.3 are affected. Upgrade to version 2.9.3 or later.

What is the impact if exploitation succeeds?

Successful exploitation can result in arbitrary code execution in the scheduler context. The reported impact includes high confidentiality, integrity, and availability consequences.

PYSEC-2024-190: Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which Airflow versions are affected?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which Airflow versions are affected?

What is the impact if exploitation succeeds?