GitHub Advisory DatabaseGHSA-976R-QFJJ-C24WCommand injection via Celery broker in Apache Airflow
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.935 High
EPSS
Percentile
99.1%
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| apache-airflow | lt | 1.10.11 |
References
github.com/advisories/GHSA-976r-qfjj-c24w
github.com/apache/airflow/commit/1dda6fdde7c6bcaf0d6534786beeeba868006dd2
github.com/apache/airflow/commit/afa4b11fddfdbadb048f742cf66d5c21c675a5c8
lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2020-11981
web.archive.org/web/20220427031325/https://issues.apache.org/jira/browse/AIRFLOW-6351
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.935 High
EPSS
Percentile
99.1%