Command Injection in Apache Airflow - CVE-2022-40127

Vulnerability details

The vulnerability allows a remote user to execute arbitrary commands.

The vulnerability exists due to improper input validation in Example Dags. A remote user with access to the UI who can trigger DAGs can pass arbitrary value for the run_id parameter and execute arbitrary commands on the system.

Affected software

How to mitigate CVE-2022-40127

Links to Public Exploits and PoC-codes

• Exploit #9216 - CVE-2022-40127-Airflow-RCE (CVE-2022-40127 PoC and exploit) (August 2, 2023)
• Exploit #9200 - CVE-2022-40127 (CVE-2022-40127 PoC and exploit) (July 23, 2023)
• Exploit #8624 - CVE-2022-40127 (Apache Airflow < 2.4.0 DAG example_bash_operator RCE POC) (November 22, 2022)

External References

• https://github.com/apache/airflow/pull/25960
• https://lists.apache.org/thread/cf132hgm6jvzvsbpsozl3plf1r4cwysy
• http://www.openwall.com/lists/oss-security/2022/11/14/2

Related Security Bulletins

• Multiple vulnerabilities in Apache Airflow