Apache Airflow 'Example DAG' Remote Code Execution

What is Apache Airflow?

Airflow is a platform to programmatically author, schedule and monitor workflows.

Use Airflow to author workflows as Directed Acyclic Graphs (DAGs) of tasks. The Airflow scheduler executes your tasks on an array of workers while following the specified dependencies. Rich command line utilities make performing complex surgeries on DAGs a snap. The rich user interface makes it easy to visualize pipelines running in production, monitor progress, and troubleshoot issues when needed.

Reference: https://airflow.apache.org/docs/apache-airflow/stable/index.html

What is Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution vulnerability?

It refers to an exploit facilitating a blind unauthenticated remote code execution in Apache Airflow. The related exploit makes use of two CVEs in Apache Airflow: CVE-2020-11978 and CVE-2020-13927.

CVE-2020-13927 Description

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default [api]auth_backend = airflow.api.auth.backend.deny_all as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default.

The base score assigned to this CVE was 9.8 (Critical)!

CVE-2020-11978 Description

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config, you are not vulnerable.

The base score assigned to this CVE was 8.8 (High)!

Lab Environment

In this lab environment, the user is going to get access to a Kali GUI instance. An Apache Airflow instance vulnerable to an unauthenticated blind remote code execution vulnerability, identified by CVE-2020-11978 and CVE-2020-13927, is running on the target server. It can be accessed using the tools installed on Kali at http://demo.ine.local:8080.

Objective: Leverage the vulnerable Apache Airflow instance to run your tasks as an unauthenticated user and gain code execution on the target server. Also, retrieve the flag from the target server!

Instructions

• This lab is dedicated to you! No other users are on this network :) 

• Once you start the lab, you will have access to a root terminal of a Kali instance

• Your Kali has an interface with IP address 192.X.Y.2. Run "ip addr" to know the values of X and Y.

• The target phpMyAdmin instance should be accessible on http://demo.ine.local:8080.

• Do not attack the gateway located at IP address 192.X.Y.1