Listen to this Post
The vulnerability exists in the Apache Airflow Providers Edge3 package versions prior to 2.0.0 when installed on an Airflow 2.x environment. This provider was never officially released for Airflow 2 and was intended for development purposes only. However, if manually installed and configured, it implicitly enables a non-public, internal RPC (Remote Procedure Call) API endpoint designed for testing the provider integration. This endpoint, which should not be accessible in a production deployment, lacks proper authorization and validation. A malicious actor with DAG author privileges can craft and submit specially formatted RPC requests to this exposed endpoint. These requests are deserialized and executed within the context of the Airflow webserver process, allowing the attacker to run arbitrary operating system commands. This grants full Remote Code Execution (RCE) on the host running the webserver, far exceeding the intended permissions of a DAG author.
Platform: Apache Airflow
Version: Edge3 Provider <2.0.0
Vulnerability: RCE via RPC
Severity: Critical
date: 2024-01-16
Prediction: Patch Available (2024-01-16)
What Undercode Say:
pip show apache-airflow-providers-edge3 pip uninstall apache-airflow-providers-edge3 -y
Check for vulnerable configuration
import airflow.configuration as conf
if conf.get('edge3', 'enabled', fallback='False') == 'True':
print("Vulnerable provider may be active.")
How Exploit:
1. Attacker gains DAG author access.
2. Discovers enabled Edge3 provider.
3. Crafts malicious RPC request.
4. Sends payload to internal API endpoint.
5. Triggers command deserialization and execution.
Protection from this CVE
Uninstall Edge3 provider from Airflow 2. Upgrade to Apache Airflow 3 and use Edge3 provider version 2.0.0 or later. Enforce strict network controls for Airflow webserver. Audit DAG author permissions.
Impact:
Remote Code Execution. Webserver Compromise. Privilege Escalation. Full System Access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
