CVE-2020-11981: Apache Airflow Remote Command Injection
Summary
CVE-2020-11981: An issue was found in Apache Airflow versions 1.10.10 and below. Affects airflow versions < 1.10.11. Fixed in 1.10.11. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2020-11981 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, manage, and monitor complex workflows as directed acyclic graphs (DAGs). The CeleryExecutor is one of the available executors in Airflow, which uses Celery as the task queueing mechanism. This vulnerability affects Apache Airflow versions 1.10.10 and below when using CeleryExecutor.
Vulnerability Detail
The vulnerability allows an attacker who can connect to the broker (Redis, RabbitMQ) directly to inject commands, leading to the execution of arbitrary commands by the Celery worker. This can result in unauthorized access, data leakage, or even the complete compromise of the affected system. The issue arises due to insufficient input validation and sanitization of user-supplied data.
How To Fix
Minimum fixed version
1.10.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to restrict direct access to the broker (Redis, RabbitMQ) from untrusted networks. By implementing network-level access controls, such as firewalls or network segmentation, the attack surface can be reduced. Additionally, it is advisable to monitor network traffic and system logs for any suspicious activity.
Conclusion
The command injection vulnerability in Apache Airflow versions 1.10.10 and below poses a significant security risk. It is crucial to promptly upgrade to version 1.10.11 or later to mitigate this vulnerability. Restricting access to the broker and monitoring for suspicious activity can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for airflow →
FAQ
Apache Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, manage, and monitor complex workflows as directed acyclic graphs (DAGs).
CeleryExecutor is one of the available executors in Apache Airflow. It uses Celery as the task queueing mechanism, allowing for distributed task execution.
The vulnerability allows an attacker to inject arbitrary commands through the broker (Redis, RabbitMQ), potentially leading to unauthorized access, data leakage, or complete compromise of the affected system.
To fix the vulnerability, it is recommended to upgrade to Apache Airflow version 1.10.11 or later, which includes a patch for the command injection vulnerability.
If immediate upgrade is not feasible, restricting direct access to the broker from untrusted networks and monitoring network traffic and system logs for suspicious activity can help mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
