Vulnerability advisory

CVE-2023-49920

Research by Md. Tareq Ahamed Jony December 21, 2023
Overview

Summary

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the execution of DAGs without the user's consent. Users are advised to upgrade to version 2.8.0 or later which is not affected

Risk profile

CVSS assessment

6.5 · M E D I U M
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
N E T W O R K
Complexity
L O W
Privileges
N O N E
User interaction
R E Q U I R E D
Scope
U N C H A N G E D
Confidentiality
N O N E
Integrity
H I G H
Availability
N O N E
Classification

Weaknesses

  • Cross-Site Request Forgery (CSRF) CWE-352
Configurations

Affected products

1 configuration
Vulnerable match
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
From 2.7.0 inclusive Through 2.7.3 inclusive
Further reading

References

3 sources
  1. www.openwall.com http://www.openwall.com/lists/oss-security/2023/12/21/3 Mailing List Third Party Advisory
  2. github.com https://github.com/apache/airflow/pull/36026 Patch
  3. lists.apache.org https://lists.apache.org/thread/mnwd2vcfw3gms6ft6kl951vfbqrxsnjq Mailing List Third Party Advisory