The version of Apache Airflow is prior to 1.10.11. It is, therefore, affected by multiple vulnerabilities, including the following:

  - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker     can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the     celery worker running arbitrary commands. (CVE-2020-11981)

  - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack     can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload     directly to the broker which could lead to a deserialization attack (and thus remote code execution) on     the Worker. (CVE-2020-11982)

  - An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection     vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any     authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on     the executor in use). If you already have examples disabled by setting load_examples=False in the config     then you are not vulnerable. (CVE-2020-11978)

  - The previous default setting for Airflow's Experimental API was to allow all API requests without     authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the     default has been changed to deny all requests by default and is documented at     https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for     new installs but existing users need to change their config to default     [api]auth_backend = airflow.api.auth.backend.deny_all as mentioned in the Updating Guide:
    https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default     (CVE-2020-13927)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Apache Airflow < 1.10.11 Multiple Vulnerabilities

critical Nessus Plugin ID 162136

Version 1.4

Version 1.3

Version 1.3

Version 1.4 Oct 20, 2023, 5:46 PM CVSSv3 score source (set to "CVE-2020-13927") Exploit attributes ("Exploit framework metasploit" set to "True") Plugin Feed: 202310201746
Version 1.3 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311
Version 1.3 Oct 20, 2023, 3:51 PM CVSSv3 score source (set to "CVE-2020-13927") Exploit attributes ("Exploit framework metasploit" set to "True") Plugin Feed: 202310201551