Internet Bug Bounty · Report #2249299

CVE-2023-47037: Airflow Broken Access Control Vulnerability

Validstatus

lowseverity

23upvotes

29 Nov 2023disclosed

Summary

CVE-2023-47037: Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access) Severity: low

Affected versions:

Apache Airflow before 2.7.3

Description: We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.

Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

Credit: Tareq Ahamed from Hackerone (reporter) Augusto Hidalgo (remediation developer)

Full Security Advisory: https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0

How it was found

Hi IBB, Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Here is the conversation between the security team of airflow.

█████

More Details: https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0

Impact

Broken Access Control Vulnerability.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original