CVE-2021-45229: Apache Airflow XSS Vulnerability
Summary
CVE-2021-45229: Apache Airflow: Reflected XSS via Origin Query Argument in URL. Affects airflow versions < 2.2.4. Fixed in 2.2.4. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2021-45229 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It allows users to define complex workflows as Directed Acyclic Graphs (DAGs) and execute them on a distributed infrastructure. This vulnerability affects Apache Airflow versions 2.2.3 and below.
Vulnerability Detail
The "Trigger DAG with config" screen in Apache Airflow is vulnerable to cross-site scripting (XSS) attacks. An attacker can exploit this vulnerability by injecting malicious code through the origin query argument. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially compromising sensitive information or performing unauthorized actions.
How To Fix
Minimum fixed version
2.2.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the "Trigger DAG with config" functionality or implement input sanitization and validation on the server-side to prevent XSS attacks. Here's an example of server-side input validation in Python:
import re
def sanitize_input(input_string):
# Remove any HTML tags
sanitized_string = re.sub('<[^<]+?>', '', input_string)
return sanitized_string
Conclusion
The XSS vulnerability in Apache Airflow's "Trigger DAG with config" screen can be exploited by injecting malicious code through the origin query argument. To mitigate this vulnerability, it is crucial to upgrade to Apache Airflow version 2.2.4 or later. Alternatively, you can disable the affected functionality or implement server-side input sanitization and validation. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a way to define complex workflows as Directed Acyclic Graphs (DAGs) and execute them on a distributed infrastructure.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, perform unauthorized actions, or deface websites.
An attacker can exploit this vulnerability by injecting malicious code through the origin query argument on the "Trigger DAG with config" screen. This code will be executed in the context of the user's browser, potentially compromising their session or performing unauthorized actions.
If successfully exploited, this vulnerability can lead to the execution of arbitrary JavaScript code in the user's browser. This can result in the theft of sensitive information, session hijacking, unauthorized actions, or defacement of the Apache Airflow interface.
Yes, the vulnerability has been fixed in Apache Airflow version 2.2.4. It is recommended to upgrade to this version or later to mitigate the risk of XSS attacks. Proper input sanitization and validation have been implemented to prevent the injection of malicious code.
References
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
