Internet Bug Bounty · Report #3078856
Apache Airflow Sql injection by authenticated user
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider.
When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have.
https://lists.apache.org/thread/7tbt8j8d291q3l1rpqs2swdf02rsq5jb
How it was found
Apache Airflow, versions 2.10.5, is affected by a vulnerability that allows an attacker can manipulate query construction, leading to an SQL Injection vulnerability that may result in remote code execution.
Impact
The DAGS that use the SQLColumnCheckOperator in the system will remote code execution.