The Apache Airflow project, which is a popular open-source workflow management platform, has reported a security vulnerability (CVE-2024-39877) affecting versions 2.4. and earlier, going back to (and including) versions 1.10.. This vulnerability allows authenticated DAG authors to exploit the doc_md parameter, resulting in arbitrary code execution in the scheduler context, which should be prohibited per the Airflow Security model. Users should upgrade to version 2.9.3 or later to mitigate this vulnerability.

Exploit Details

The vulnerability exists because Apache Airflow does not correctly validate the input for the doc_md field while defining a DAG object. An authenticated user with the ability to create or modify DAGs can insert malicious code into the doc_md field, which is then executed in the scheduler context. This allows an attacker to perform arbitrary actions on the system, potentially compromising data or causing a denial-of-service attack.

Here's a code snippet illustrating the exploit

from airflow import DAG
from airflow.operators.python_operator import PythonOperator
from datetime import datetime

def evil_function(*args, **kwargs):
    # Malicious code executed in the scheduler context
    pass

dag = DAG(
    dag_id='vulnerable_dag',
    default_args={
        'owner': 'airflow',
        'start_date': datetime(2024, 1, 1),
    },
    schedule_interval='@daily',
    catchup=False,
)

vulnerable_task = PythonOperator(
    task_id='vulnerable_task',
    python_callable=evil_function,
    op_args=[],
    op_kwargs={},
    provide_context=True,
    dag=dag,
)

# Exploiting the doc_md parameter with malicious code
vulnerable_task.doc_md = """[Here's some useful info](javascript:alert('This is malicious code'))"""

This example shows a malicious doc_md parameter, which will execute JavaScript in the context of the scheduler, potentially leading to security issues. In real-world scenarios, this could allow an attacker to execute various malicious actions, such as accessing sensitive data or causing downtime for the affected Airflow instance.

References and Mitigation

Apache Airflow has addressed this vulnerability in version 2.9.3, and users should upgrade to this version or later to resolve the issue. For more information on the vulnerability, refer to the following links:

- CVE-2024-39877: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39877
- Apache Airflow official documentation: https://airflow.apache.org/docs/apache-airflow/stable/security.html
- Apache Airflow 2.9.3 release notes: https://github.com/apache/airflow/blob/main/CHANGELOG.rst#293---2024-05-03

Conclusion

In conclusion, the CVE-2024-39877 vulnerability in Apache Airflow allows authenticated users to execute arbitrary code within the scheduler context by exploiting the doc_md parameter. Users of Airflow versions 2.4. and earlier, including versions 1.10. and up, should upgrade to version 2.9.3 or later to address this security vulnerability.

Timeline

Published on: 07/17/2024 08:15:02 UTC
Last modified on: 08/01/2024 13:56:00 UTC