CVE-2024-28746
📋 TL;DR
This vulnerability in Apache Airflow allows authenticated users with limited permissions to access sensitive resources like variables and connections through the UI that they shouldn't have permission to view. It affects Airflow versions 2.8.0 through 2.8.2. This is an authorization bypass issue that could lead to information disclosure.
💻 Affected Systems
- Apache Airflow
📦 What is this software?
Airflow by Apache
⚠️ Risk & Real-World Impact
Worst Case
An authenticated low-privilege user could access sensitive configuration data like database credentials, API keys, or other secrets stored in Airflow variables and connections, potentially leading to full system compromise.
Likely Case
Internal users with basic permissions could access sensitive configuration data they shouldn't see, leading to information disclosure and potential credential theft.
If Mitigated
With proper network segmentation and access controls, the impact is limited to unauthorized viewing of configuration data within the Airflow environment.
🎯 Exploit Status
Requires authenticated access but minimal technical skill to exploit through the UI.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.8.3 or newer
Vendor Advisory: https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7
Restart Required: Yes
Instructions:
1. Backup your Airflow deployment. 2. Upgrade to Airflow 2.8.3 or newer using pip: 'pip install --upgrade apache-airflow==2.8.3'. 3. Restart all Airflow components (webserver, scheduler, workers). 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict UI Access
allLimit access to the Airflow UI to only trusted administrators until patching can occur.
Configure firewall rules or reverse proxy to restrict UI access
Use network segmentation to isolate Airflow UI
Review and Rotate Secrets
allAudit and rotate any sensitive credentials stored in Airflow variables and connections.
Review Airflow variables and connections for sensitive data
Rotate any exposed credentials or API keys
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the Airflow UI
- Regularly audit and rotate all credentials stored in Airflow variables and connections
🔍 How to Verify
Check if Vulnerable:
Check Airflow version: if between 2.8.0 and 2.8.2 inclusive, you are vulnerable.Check Version:
airflow versionVerify Fix Applied:
Verify Airflow version is 2.8.3 or newer and test that low-privilege users cannot access restricted resources.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to variables or connections endpoints
- Users accessing resources outside their permission scope
Network Indicators:
- Unusual patterns of requests to Airflow UI from low-privilege users
SIEM Query:
source="airflow" AND (uri_path="/variable" OR uri_path="/connection") AND user_role!="Admin"🔗 References
- http://www.openwall.com/lists/oss-security/2024/03/13/5
- https://github.com/apache/airflow/pull/37881
- https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7
- http://www.openwall.com/lists/oss-security/2024/03/13/5
- https://github.com/apache/airflow/pull/37881
- https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7
