CVE-2024-45498: Apache Airflow command execution in example DAGs

Executive brief

Apache Airflow, a platform used to automate and schedule complex data workflows, contains a security flaw in one of its example configuration files. An authorized user with permission to trigger workflows could exploit this flaw to run unauthorized commands on the server. This could lead to a full system compromise, data theft, or disruption of business operations.

Technical details

A vulnerability exists in the 'example_inlet_event_extra.py' DAG file shipped with Apache Airflow 2.10.0 due to improper encoding or escaping of output (CWE-116). An authenticated attacker with 'DAG trigger' permissions can exploit this to achieve arbitrary command execution on the Airflow worker or scheduler. The issue stems from how the example DAG handles inputs, allowing for command injection. Users who used this example as a template for their own production DAGs are also at risk. The vulnerability is remediated in version 2.10.1, and it is recommended to disable example DAGs in production environments.

Affected products

• Apache Airflow 2.10.0

Timeline

• 2024-09-07: disclosed
• 2024-09-07: advisory
• 2024-09-07: patched: Released in version 2.10.1

References

• https://api.github.com/users/exolightor
• https://github.com/exolightor
• https://api.github.com/users/exolightor/gists%7B/gist_id%7D
• https://api.github.com/users/exolightor/repos
• https://avatars.githubusercontent.com/u/86409447?v=4
• https://api.github.com/users/exolightor/events%7B/privacy%7D