Internet Bug Bounty · Report #1891795

RCE vulnerability in apache-airflow-providers-apache-sqoop 3.1.0

Validstatus

mediumseverity

$2,400bounty

30upvotes

18 Mar 2023disclosed

Summary

CVE-2023-25693: Sqoop Apache Airflow Provider Remote Code Execution Vulnerability Severity: moderate

Description: Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider.

This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.

Credit:

L3yx of Syclover Security Team (finder)

Full Security Advisory: https://lists.apache.org/thread/79qn8g5xbq036f8crb115obvr22l52q4

How it was found

In airflow.providers.apache.sqoop.hooks.sqoop.SqoopHook._prepare_command, users can control -libjars through libjars in Connection. -libjars makes sure each MR task gets these jars in classpath, So I can set this as a malicious Jar package, causing arbitrary system commands to be executed on the machine performing the MR task.

This is a screenshot of my email reporting this vulnerability ██████████

Impact

Remote Code Execution

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original