An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin
    management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with
    appropriate permissions to create stored XSS attacks. (CVE-2020-11983)

The version of Apache Airflow is prior to 1.10.11. It is, therefore, affected by multiple vulnerabilities, including the following:

  - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker     can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the     celery worker running arbitrary commands. (CVE-2020-11981)

  - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack     can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload     directly to the broker which could lead to a deserialization attack (and thus remote code execution) on     the Worker. (CVE-2020-11982)

  - An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection     vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any     authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on     the executor in use). If you already have examples disabled by setting load_examples=False in the config     then you are not vulnerable. (CVE-2020-11978)

  - The previous default setting for Airflow's Experimental API was to allow all API requests without     authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the     default has been changed to deny all requests by default and is documented at     https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for     new installs but existing users need to change their config to default     [api]auth_backend = airflow.api.auth.backend.deny_all as mentioned in the Updating Guide:
    https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default     (CVE-2020-13927)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
417868	SCA: security update for apache-airflow (GHSA-q4p3-qw5c-mhpc)	Tenable Cloud Security	SCA Checks	medium
417868	SCA: security update for apache-airflow (GHSA-q4p3-qw5c-mhpc)	Tenable Self-Hosted Container Security	SCA Checks	medium
162136	Apache Airflow < 1.10.11 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2020-11983

medium

Tenable Plugins

medium

medium

critical