CVE-2024-42447
📋 TL;DR
This vulnerability in Apache Airflow's FAB provider prevents users from logging out, potentially allowing unauthorized access to sessions. It affects Airflow installations using FAB provider versions 1.2.0 or 1.2.1 (specifically with Airflow 2.9.3). Attackers could hijack active sessions to gain unauthorized access to Airflow instances.
💻 Affected Systems
- Apache Airflow
- Apache Airflow Providers FAB
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain persistent access to Airflow admin interfaces, potentially compromising data pipelines, stealing credentials, or disrupting critical workflows.
Likely Case
Unauthorized users maintain access to Airflow UI after legitimate users think they've logged out, leading to data exposure and privilege escalation.
If Mitigated
With proper network segmentation and access controls, impact is limited to the Airflow instance itself rather than broader infrastructure.
🎯 Exploit Status
Exploitation requires access to an active session, but logout prevention makes session hijacking easier.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apache Airflow Providers FAB 1.2.2
Vendor Advisory: https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52
Restart Required: Yes
Instructions:
1. Upgrade to FAB provider 1.2.2 using pip: 'pip install --upgrade apache-airflow-providers-fab==1.2.2' 2. Restart Airflow services 3. For container deployments, pull latest Airflow images or rebuild with updated constraints
🔧 Temporary Workarounds
Force session timeout
allConfigure shorter session timeouts to limit exposure
Set AIRFLOW__WEBSERVER__SESSION_LIFETIME_MINUTES to lower value in airflow.cfg
🧯 If You Can't Patch
- Implement network segmentation to restrict Airflow access to trusted users only
- Monitor for unusual session activity and implement additional authentication layers
🔍 How to Verify
Check if Vulnerable:
Check FAB provider version: 'pip show apache-airflow-providers-fab' and verify if using 1.2.0 or 1.2.1 (with Airflow 2.9.3)Check Version:
pip show apache-airflow-providers-fab | grep VersionVerify Fix Applied:
Confirm FAB provider version is 1.2.2 or higher and test logout functionality📡 Detection & Monitoring
Log Indicators:
- Failed logout attempts
- Unusually long session durations
- Multiple sessions from same user
Network Indicators:
- Repeated authentication requests without logout events
SIEM Query:
source="airflow" AND (event="logout_failed" OR session_duration>24h)