CVE-2020-13944: Apache Airflow XSS Vulnerability
Summary
CVE-2020-13944: In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. Affects airflow across 2 version ranges.
< 1.10.15
>= 2.0.0, < 2.0.2
Fixed in 1.10.15 or 2.0.2, depending on the release line you run. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2020-13944 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define complex workflows as Directed Acyclic Graphs (DAGs) and execute them on a distributed infrastructure. This vulnerability affects versions prior to 1.10.12 of Apache Airflow. The 'origin' parameter passed to certain endpoints, such as '/trigger', is susceptible to a Cross-Site Scripting (XSS) exploit.
Vulnerability Detail
The 'origin' parameter in Apache Airflow, when not properly sanitized, allows an attacker to inject malicious scripts into the application. This can lead to the execution of arbitrary code in the context of the user's browser, potentially compromising sensitive information or performing unauthorized actions. The vulnerability has a Medium severity rating with a CVSS score of 3.1. It requires network access and user interaction to exploit.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.10.151.10.15 -
>= 2.0.0, < 2.0.22.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, Apache Airflow versions prior to 1.10.12 are vulnerable to a Cross-Site Scripting (XSS) exploit. It is crucial to upgrade to the fixed versions mentioned to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows an attacker to execute arbitrary code in the user's browser, potentially compromising sensitive information or performing unauthorized actions.
This vulnerability has a Medium severity rating with a CVSS score of 3.1.
To fix this vulnerability, upgrade to Apache Airflow version 1.10.12 or later, or version 2.0.2 or later.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
