CVE-2024-32077
📋 TL;DR
CVE-2024-32077 is a cross-site scripting (XSS) vulnerability in Apache Airflow 2.9.0 that allows authenticated attackers to inject malicious scripts into task instance logs. When viewed by administrators or other users, these scripts execute in their browser context, potentially leading to session hijacking or unauthorized actions. This affects all Apache Airflow 2.9.0 deployments with authenticated user access.
💻 Affected Systems
- Apache Airflow
📦 What is this software?
Airflow by Apache
Airflow by Apache
Airflow by Apache
Airflow by Apache
Airflow by Apache
Airflow by Apache
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could steal administrator session cookies, perform actions as administrators, or redirect users to malicious sites, potentially leading to full system compromise.
Likely Case
Attackers with authenticated access inject malicious scripts into logs that execute when viewed by other users, leading to session hijacking or limited unauthorized actions.
If Mitigated
With proper input validation and output encoding, malicious scripts are rendered harmless as text rather than executable code.
🎯 Exploit Status
Exploitation requires authenticated access to Airflow. The vulnerability is in log rendering, making exploitation straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.1
Vendor Advisory: https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
Restart Required: Yes
Instructions:
1. Backup your Airflow configuration and database. 2. Stop all Airflow services. 3. Upgrade Airflow using pip: 'pip install --upgrade apache-airflow==2.9.1'. 4. Run database migrations: 'airflow db upgrade'. 5. Restart all Airflow services.
🔧 Temporary Workarounds
Disable log viewing for non-administrators
allRestrict access to task instance logs to administrators only to reduce attack surface.
Configure Airflow RBAC to limit 'can_log' permission to admin role only
Implement Content Security Policy (CSP)
allAdd CSP headers to prevent execution of injected scripts.
Add 'Content-Security-Policy: default-src 'self'' to web server configuration
🧯 If You Can't Patch
- Implement strict input validation and output encoding for all user-controlled data in logs
- Monitor and audit log access patterns for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Airflow version: 'airflow version' should show 2.9.0 if vulnerable.Check Version:
airflow versionVerify Fix Applied:
After upgrade, verify version: 'airflow version' should show 2.9.1 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual script tags or JavaScript in task instance logs
- Multiple failed log injection attempts
Network Indicators:
- Unexpected outbound connections from Airflow web interface to external domains
SIEM Query:
source="airflow" AND ("<script" OR "javascript:" OR "onerror=" OR "onload=")🔗 References
- http://www.openwall.com/lists/oss-security/2024/05/14/1
- https://github.com/apache/airflow/pull/38882
- https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
- http://www.openwall.com/lists/oss-security/2024/05/14/1
- https://github.com/apache/airflow/pull/38882
- https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
