An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection
    vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any
    authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on
    the executor in use). If you already have examples disabled by setting load_examples=False in the config
    then you are not vulnerable. (CVE-2020-11978)

The version of Apache Airflow is prior to 1.10.11. It is, therefore, affected by multiple vulnerabilities, including the following:

  - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker     can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the     celery worker running arbitrary commands. (CVE-2020-11981)

  - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack     can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload     directly to the broker which could lead to a deserialization attack (and thus remote code execution) on     the Worker. (CVE-2020-11982)

  - An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection     vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any     authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on     the executor in use). If you already have examples disabled by setting load_examples=False in the config     then you are not vulnerable. (CVE-2020-11978)

  - The previous default setting for Airflow's Experimental API was to allow all API requests without     authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the     default has been changed to deny all requests by default and is documented at     https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for     new installs but existing users need to change their config to default     [api]auth_backend = airflow.api.auth.backend.deny_all as mentioned in the Updating Guide:
    https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default     (CVE-2020-13927)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
418944	SCA: security update for apache-airflow (GHSA-rvmq-4x66-q7j3)	Tenable Cloud Security	SCA Checks	high
418944	SCA: security update for apache-airflow (GHSA-rvmq-4x66-q7j3)	Tenable Self-Hosted Container Security	SCA Checks	high
162136	Apache Airflow < 1.10.11 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2020-11978

high

Tenable Plugins

high

high

critical