Patchfirst
Patchfirst
CVE-2021-38540 Public exploit EPSS 80.9%

Apache Airflow: Variable Import endpoint missed authentication check

Apache Software Foundation · Apache Airflow

Summary

The Variable Import endpoint in Apache Software Foundation's Apache Airflow lacked an authentication check, so it was reachable without credentials. An unauthenticated remote attacker who can reach the endpoint over the network could add or modify Airflow variables used by DAGs, which could lead to denial of service, information disclosure, or remote code execution.

Official description · CVE.org

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.

Breakdown
24.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) appeared 9 months after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+9 mo

2 related vulnerabilities in the same code over 2 years. The latest fix listed for apache-airflow is 2.2.4.

Linked vulnerabilitiesLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2021-38540Airflow: Variable Import endpoint missed authentication check9 Sep 2021
  2. relatedMedium

    Why these are linked:

    CVE-2023-50783Airflow: Improper access control vulnerability on the…21 Dec 2023

Fixes in apache-airflowPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.0.2rc1CVE-2020-1751511 Dec 2020
  2. 2.0.2CVE-2021-283592 May 2021
  3. 2.1.2CVE-2021-3593616 Aug 2021
  4. 2.1.3CVE-2021-385409 Sep 2021
  5. 2.2.0CVE-2021-4523020 Jan 2022
  6. 2.2.4rc1CVE-2021-4522925 Feb 2022
  7. 2.2.4CVE-2022-2428825 Feb 2022Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: apache-airflow.

PyPIapache-airflowGHSA-h88f-r7cw-8fv3PYSEC-2021-326

Upgrade to 2.4.3 or later

Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2022-24288, CVE-2022-40127, +1).

pippip install "apache-airflow>=2.4.3"

First fixed in 2.1.3 for CVE-2021-38540.

Affected versions

If you runUpgrade to
2.0.0 up to 2.1.32.4.3first fix for this CVE: 2.1.3

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

x_refsource_MISC 1

lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E

mailing-list 1

lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2%40%3Cannounce.apache.org%3E
↑ ↓ chooseEnter openEsc close