Executive brief
A vulnerability in the Apache Airflow FAB provider prevents users from properly logging out of the system. This means that if a user accesses Airflow from a shared or public computer, their session could remain active even after they attempt to sign out. An unauthorized person could potentially use the abandoned session to access sensitive data or perform actions on behalf of the original user.
Technical details
An Insufficient Session Expiration vulnerability (CWE-613) exists in the Apache Airflow FAB (Flask AppBuilder) provider. The flaw is rooted in a version check logic error related to logout CSRF protection, which effectively prevents the logout mechanism from terminating the user session. The issue specifically affects FAB provider version 1.2.0 across all Airflow versions, and version 1.2.1 specifically when paired with Airflow 2.9.3. Attackers could leverage an unexpired session on a shared workstation to gain unauthorized access to the Airflow web interface. The issue is resolved in Apache Airflow Providers FAB version 1.2.2.
Affected products
- Apache Airflow Providers FAB 1.2.0, 1.2.1 (when used with Airflow 2.9.3)
Timeline
- 2024-08-04: disclosed: Initial disclosure on oss-security mailing list
- 2024-08-05: advisory: GitHub and NVD advisories published