Patchfirst
Patchfirst
CVE-2022-40127 Public exploit High · 8.8 EPSS 85.7%

Apache Airflow <2.4.0 has an RCE in a bash example

Apache Software Foundation · Apache Airflow

Summary

The flaw is a code injection vulnerability in the Example DAGs bundled with Apache Airflow, affecting versions prior to 2.4.0. An attacker holding UI access with permission to trigger DAGs can execute arbitrary commands by supplying a crafted run_id parameter manually, with no user interaction required.

Official description · CVE.org

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.

Breakdown
31.1 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) appeared 4 days after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+4 days

7 fixes in apache-airflow over 2 months. The latest fix listed for apache-airflow is 2.4.2.

Fixes in apache-airflowPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.3.4CVE-2022-381702 Sep 2022
  2. 2.4.0rc1CVE-2022-4060421 Sep 2022
  3. 2.4.0rc1CVE-2022-4075421 Sep 2022
  4. 2.4.0CVE-2022-4012714 Nov 2022
  5. 2.4.2rc1CVE-2022-416727 Oct 2022
  6. 2.4.2CVE-2022-439822 Nov 2022
  7. 2.4.2CVE-2022-439852 Nov 2022Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: apache-airflow.

PyPIapache-airflowGHSA-6pw3-8h9w-32gcPYSEC-2022-42982

Upgrade to 2.4.3 or later

Fixes this CVE and 5 other known vulnerabilities in this package (CVE-2020-11978, CVE-2020-13927, +3).

pippip install "apache-airflow>=2.4.3"

First fixed in 2.4.0 for CVE-2022-40127.

Affected versions

If you runUpgrade to
All versions before 2.4.02.4.3first fix for this CVE: 2.4.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

3 links, grouped by NVD tag

Other 2

github.com/apache/airflow/pull/25960lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy

mailing-list 1

openwall.com/lists/oss-security/2022/11/14/2
↑ ↓ chooseEnter openEsc close