CVE-2020-11982: Apache Airflow Remote Code Execution
Summary
CVE-2020-11982: An issue was found in Apache Airflow versions 1.10.10 and below. Affects airflow versions < 1.10.11. Fixed in 1.10.11. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2020-11982 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define complex workflows as Directed Acyclic Graphs (DAGs) and execute them on a distributed infrastructure. Airflow supports various executors, including CeleryExecutor, which uses message brokers like Redis or RabbitMQ for task distribution. This vulnerability affects Apache Airflow versions 1.10.10 and below when using CeleryExecutor.
Vulnerability Detail
The vulnerability allows an attacker to execute arbitrary code remotely on the Airflow worker by exploiting a deserialization vulnerability. If the attacker can connect directly to the message broker (Redis, RabbitMQ), they can insert a malicious payload that will be deserialized by the worker, leading to remote code execution. This can have severe consequences, allowing an attacker to gain unauthorized access, escalate privileges, or perform other malicious actions on the affected system.
How To Fix
Minimum fixed version
1.10.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to restrict direct access to the message broker from untrusted networks. This can be achieved by configuring network-level access controls or using firewall rules to limit access to the broker's port. Additionally, it is recommended to monitor the broker for any suspicious activity and apply any available security patches or updates.
Conclusion
The CVE-2020-11982 vulnerability in Apache Airflow allows for remote code execution, posing a significant security risk. It is crucial to upgrade to the latest version of Airflow and implement proper security measures to protect against this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows.
CeleryExecutor is one of the executors supported by Apache Airflow. It uses message brokers like Redis or RabbitMQ for task distribution.
A deserialization attack occurs when an attacker manipulates serialized data to execute arbitrary code on a target system.
This vulnerability can allow an attacker to execute arbitrary code remotely on the Airflow worker, potentially leading to unauthorized access, privilege escalation, or other malicious actions.
To mitigate this vulnerability, it is recommended to upgrade to Apache Airflow version 1.10.11 or later and ensure proper security measures are in place for the message broker.
References
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
