An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker
    can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the
    celery worker running arbitrary commands. (CVE-2020-11981)

The version of Apache Airflow is prior to 1.10.11. It is, therefore, affected by multiple vulnerabilities, including the following:

  - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker     can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the     celery worker running arbitrary commands. (CVE-2020-11981)

  - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack     can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload     directly to the broker which could lead to a deserialization attack (and thus remote code execution) on     the Worker. (CVE-2020-11982)

  - An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection     vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any     authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on     the executor in use). If you already have examples disabled by setting load_examples=False in the config     then you are not vulnerable. (CVE-2020-11978)

  - The previous default setting for Airflow's Experimental API was to allow all API requests without     authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the     default has been changed to deny all requests by default and is documented at     https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for     new installs but existing users need to change their config to default     [api]auth_backend = airflow.api.auth.backend.deny_all as mentioned in the Updating Guide:
    https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default     (CVE-2020-13927)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
413098	SCA: security update for apache-airflow (GHSA-976r-qfjj-c24w)	Tenable Cloud Security	SCA Checks	Local	critical
413098	SCA: security update for apache-airflow (GHSA-976r-qfjj-c24w)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
162136	Apache Airflow < 1.10.11 Multiple Vulnerabilities	Nessus	Misc.	Remote	critical

Detections

Analytics

CVE-2020-11981

critical

Tenable Plugins

critical

critical

critical