Apache Airflow < 1.10.11 - Authenticated Remote Code Execution via Example DAG
Title source: llmExploitation Summary
CVE-2020-11978 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 18, 2022.
EIP tracks 3 public exploits from researchers including pberba, xuxiang, Pepe Berba, Ismail E. Dawoodjee, including a Metasploit module exploits/linux/http/apache_airflow_dag_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2020-11978, a remote code execution vulnerability in Apache Airflow's example DAGs. The exploit leverages command injection in the `example_trigger_target_dag` via the experimental REST API, which can be accessed unauthenticated when combined with CVE-2020-13927.
Description
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
Exploits (3)
This repository contains a proof-of-concept exploit for CVE-2020-11978, a remote code execution vulnerability in Apache Airflow's example DAGs. The exploit leverages command injection in the `example_trigger_target_dag` via the experimental REST API, which can be accessed unauthenticated when combined with CVE-2020-13927.
This exploit leverages CVE-2020-11978 in Apache Airflow <= 1.10.10 by injecting a command into the 'example_trigger_target_dag' via the Experimental REST API, achieving remote code execution. It combines with CVE-2020-13927 for unauthenticated access.
This Metasploit module exploits CVE-2020-11978, an authenticated command injection vulnerability in Apache Airflow 1.10.10, combined with CVE-2020-13927 (unauthenticated API access) to achieve unauthenticated RCE. It creates a vulnerable DAG and injects commands via the 'example_trigger_target_dag' example.
Nuclei Templates (1)
title:"Airflow - DAGs" || http.html:"Apache Airflow" || http.title:"airflow - dags" || http.html:"apache airflow" || http.title:"sign in - airflow" || product:"redis"
title="sign in - airflow" || apache airflow || title="airflow - dags" || http.html:"apache airflow"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H