CVE-2023-39508
Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0
This issue affects Apache Airflow: before 2.6.0.
*Credits:
balis0ng
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-08-03 CVE Reserved
- 2023-08-05 CVE Published
- 2024-08-24 EPSS Updated
- 2024-10-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-250: Execution with Unnecessary Privileges
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
http://seclists.org/fulldisclosure/2023/Jul/43 | Not Applicable |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://github.com/apache/airflow/pull/29706 | 2023-08-09 |
URL | Date | SRC |
---|---|---|
https://lists.apache.org/thread/j2nkjd0zqvtqk85s6ywpx3c35pvzyx15 | 2023-08-09 |