Apache Airflow Example DAG Command Injection

Product: Apache Airflow
CVE: CVE-2020-11978
Disclosed: 2020-07-16
CVSS: 8.8
Auth: requires auth / interaction
CISA KEV: yes
Affected: Airflow <= 1.10.10 with example DAGs loaded
Fixed: 1.10.11

Summary

One of the example DAGs shipped with Airflow passed trigger configuration straight into a Bash command. Combined with Airflow's unauthenticated experimental API (CVE-2020-13927) on many deployments, attackers could run commands on workers.

Root cause

example_trigger_target_dag used a BashOperator that templated dag_run.conf['message'] into a shell command. Anyone able to trigger the DAG with custom conf could inject shell metacharacters, executing as the worker/scheduler user.

Impact

Remote command execution on Airflow workers, which typically hold credentials for data infrastructure.

Public PoC

// Trigger example_trigger_target_dag with this conf:
{"message":"'\";touch /tmp/airflow_dag_success;#"}

Source: vulhub - airflow/CVE-2020-11978

Detection

Check load_examples setting and version; look for dag_run conf values containing quotes, semicolons or backticks for example_trigger_target_dag.

Mitigation

Upgrade to 1.10.11+, set load_examples=False, and require authentication on the API.