Internet Bug Bounty · Report #3073507
Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli
Summary
nsufficient Session Expiration vulnerability in Apache Airflow Fab Provider.
This issue affects Apache Airflow Fab Provider: before 1.5.2.
When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from CVE-2023-40273 which was addressed in Apache-Airflow 2.7.0
Users are recommended to upgrade to version 1.5.2, which fixes the issue.
How it was found
When a user changes his password by visiting /resetmypassword form, the application terminates all the existing sessions. This is to defend against the attack scenario when a user believes his account is hacked and so changes the password to ensure that he/she is the only one knowing the password in case the old password was compromised or session-id was compromised let us say using an XSS attack and then the application logs out all users making sure the attacker is also logged out and the legitimate user can safely log back in using the new password. However it has been observed that the application fails to terminate existing sessions if the password change was done by airflow cli tool.
Allocated CVE: CVE-2024-45033
Advisory: https://github.com/advisories/GHSA-8863-4qmg-fr45
Pull request that fix the issue: https://github.com/apache/airflow/pull/45139
Email communication between me (reporter) and the security team of Apache Airflow: {F4208960}
Impact
Account takeover possibility due to insufficient session expiration vulnerability in Apache Airflow Fab Provider.