Vulnerability Details : CVE-2020-11978
Public exploit exists!
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
Products affected by CVE-2020-11978
- cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
CVE-2020-11978 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Apache Airflow Command Injection
CISA required action:
Apply updates per vendor instructions.
CISA description:
A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2020-11978
Added on
2022-01-18
Action due date
2022-07-18
Exploit prediction scoring system (EPSS) score for CVE-2020-11978
97.29%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2020-11978
-
Apache Airflow 1.10.10 - Example DAG Remote Code Execution
Disclosure Date: 2020-07-14First seen: 2023-10-08exploit/linux/http/apache_airflow_dag_rceThis module exploits an unauthenticated command injection vulnerability by combining two critical vulnerabilities in Apache Airflow 1.10.10. The first, CVE-2020-11978, is an authenticated command injection vulnerability found in one of Airflow's example DAGs,
CVSS scores for CVE-2020-11978
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2020-11978
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-11978
-
https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
Apache Airflow security vulnerabilities fixed in v1.10.11: CVE-2020-9485, CVE-2020-11978, CVE-2020-11981, CVE-2020-11982, CVE-2020-11983, CVE-2020-13927 - Pony MailMailing List;Vendor Advisory
-
http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html
Apache Airflow 1.10.10 Remote Code Execution ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html
Apache Airflow 1.10.10 Remote Code Execution ≈ Packet StormExploit;Third Party Advisory;VDB Entry
Jump to