CVE-2025-30473
📋 TL;DR
This SQL injection vulnerability in Apache Airflow Common SQL Provider allows authenticated UI users to inject arbitrary SQL commands via the partition_clause parameter in SQLTableCheckOperator. This enables privilege escalation to execute unauthorized database operations. It affects all Apache Airflow installations using Common SQL Provider before version 1.24.1.
💻 Affected Systems
- Apache Airflow Common SQL Provider
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, modification, deletion, or remote code execution on the database server.
Likely Case
Unauthorized data access, privilege escalation within the database, and potential data manipulation.
If Mitigated
Limited to authenticated user access scope with proper input validation and parameterized queries.
🎯 Exploit Status
Exploitation requires authenticated UI user access and knowledge of SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.24.1
Vendor Advisory: https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2
Restart Required: Yes
Instructions:
1. Stop Airflow services. 2. Upgrade Apache Airflow Common SQL Provider to version 1.24.1 using pip: 'pip install --upgrade apache-airflow-providers-common-sql==1.24.1'. 3. Restart Airflow services.
🔧 Temporary Workarounds
Disable SQLTableCheckOperator with partition_clause parameter
allRemove or disable usage of SQLTableCheckOperator with partition_clause parameter in DAG configurations.
Review and modify DAG files to remove partition_clause parameter usage in SQLTableCheckOperator
Implement input validation
allAdd custom input validation for partition_clause parameter before passing to SQLTableCheckOperator.
Implement parameter validation in DAG code to sanitize partition_clause input
🧯 If You Can't Patch
- Restrict Airflow UI access to only trusted users with minimal necessary privileges.
- Implement network segmentation to isolate Airflow instances from critical database systems.
🔍 How to Verify
Check if Vulnerable:
Check if Apache Airflow Common SQL Provider version is below 1.24.1 and if SQLTableCheckOperator with partition_clause parameter is used.Check Version:
pip show apache-airflow-providers-common-sql | grep VersionVerify Fix Applied:
Verify installed version is 1.24.1 or higher and test SQLTableCheckOperator functionality with partition_clause.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in Airflow logs
- Multiple failed authentication attempts followed by SQLTableCheckOperator usage
- Unexpected database errors from Airflow processes
Network Indicators:
- Unusual database connections from Airflow hosts
- Suspicious SQL patterns in database query logs
SIEM Query:
source="airflow.logs" AND ("SQLTableCheckOperator" OR "partition_clause") AND (sql_injection_indicators OR error OR unauthorized)🔗 References
- https://github.com/apache/airflow/pull/48098
- https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2
- http://www.openwall.com/lists/oss-security/2025/04/04/2
- http://www.openwall.com/lists/oss-security/2025/04/06/1
- http://www.openwall.com/lists/oss-security/2025/04/06/2
- http://www.openwall.com/lists/oss-security/2025/04/06/3
