Internet Bug Bounty · Report #1776476

CVE-2022-40127: RCE in Apache Airflow <2.4.0 bash example

Validstatus

highseverity

$4,000bounty

60upvotes

5 Jan 2023disclosed

Summary

Description:

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

Mitigation:

Do not enable example dags on systems that should not allow UI user to execute an arbitrary command.

References:

https://github.com/apache/airflow/pull/25960

How it was found

airflow-2.3.3/airflow/example_dags/example_bash_operator.py has a command injection vulnerability. I can control the run_id in the following code(example_bash_operator.py),So I can inject custom commands.

    also_run_this = BashOperator(
        task_id='also_run_this',
        bash_command='echo "run_id={{ run_id }} | dag_run={{ dag_run }}"',
    )

Enter the DAGs menu and start example_bash_operator task, select “Trigger DAG w/ config”.Set the run_id to " touch /tmp/success " and trigger.

{F2036322}

Impact

Execute any OS command

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original