CVE-2020-13927
published 2020-11-10CVE-2020-13927: The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who…
PriorityP197critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-07-18
Exploited in the wild
EPSS
99.67%
99.9th percentile
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | < 1.10.11 | 1.10.11 |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET HUNTING Possible Apache Airflow Experimental API Authentication Bypass Attempt (CVE-2020-13927)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/experimental/test"; fast_pattern; reference:cve,2020-13927; classtype:attempted-admin; sid:2035037; rev:2; metadata:created_at 2022_02_01, cve CVE_2020_13927, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Probe for unauthenticated access: HTTP GET to /api/experimental/test returning HTTP 200 without credentials indicates the auth bypass is active. ↗
- →Exploitation chain targets the 'example_trigger_target_dag' DAG and its 'bash_task' task; monitor for unauthenticated GET/POST requests to these API paths. ↗
- →Command injection payload is delivered via the 'message' field in the DAG run conf JSON body as a shell injection string ("; <cmd> #). ↗
- →Nuclei template detection: unauthenticated GET to /api/experimental/latest_runs; response body containing all three strings '"dag_run_url":', '"dag_id":', '"items":' confirms vulnerability.
- →Shodan/FOFA fingerprinting: exposed Airflow instances can be identified by page title 'Airflow - DAGs' or HTML content 'Apache Airflow'.
- →Metasploit module available for this combined CVE-2020-11978 + CVE-2020-13927 unauthenticated RCE chain targeting Apache Airflow 1.10.10. ↗
- ·Existing Airflow installs (pre-1.10.11) must explicitly set the config value [api]auth_backend = airflow.api.auth.backend.deny_all; upgrading alone does not fix already-deployed instances. ↗
- ·The vulnerability is also exploitable when example DAGs are loaded (load_examples=True); disabling example DAGs or deleting example_trigger_target_dag mitigates the chained RCE (CVE-2020-11978) component. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Authentication bypass in Apache Airflow
ghsa·2021-04-30
CVE-2020-13927 [CRITICAL] CWE-1056 Authentication bypass in Apache Airflow
Authentication bypass in Apache Airflow
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
OSV
Authentication bypass in Apache Airflow
osv·2021-04-30
CVE-2020-13927 [CRITICAL] Authentication bypass in Apache Airflow
Authentication bypass in Apache Airflow
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
OSV
CVE-2020-13927: The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to use
osv·2020-11-10
CVE-2020-13927 CVE-2020-13927: The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to use
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
VulnCheck
Apache Airflow's Experimental API Authentication Bypass
vulncheck·2020·CVSS 9.8
CVE-2020-13927 [CRITICAL] CWE-1188 Apache Airflow's Experimental API Authentication Bypass
Apache Airflow's Experimental API Authentication Bypass
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
Affected: Apache Airflow
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-07-18
CISA
Apache Airflow's Experimental API Authentication Bypass
cisa·2022-01-18·CVSS 9.8
CVE-2020-13927 [CRITICAL] CWE-1188 Apache Airflow's Experimental API Authentication Bypass
Vulnerability: Apache Airflow's Experimental API Authentication Bypass
Affected: Apache Airflow's Experimental API
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-13927
Remediation Due Date: 2022-07-18
Suricata
ET HUNTING Possible Apache Airflow Experimental API Authentication Bypass Attempt (CVE-2020-13927)
suricata·2022-02-01·CVSS 9.8
CVE-2020-13927 [CRITICAL] ET HUNTING Possible Apache Airflow Experimental API Authentication Bypass Attempt (CVE-2020-13927)
ET HUNTING Possible Apache Airflow Experimental API Authentication Bypass Attempt (CVE-2020-13927)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET HUNTING Possible Apache Airflow Experimental API Authentication Bypass Attempt (CVE-2020-13927)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/experimental/test"; fast_pattern; reference:cve,2020-13927; classtype:attempted-admin; sid:2035037; rev:2; metadata:created_at 2022_02_01, cve CVE_2020_13927, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing
Exploit-DB
Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
exploitdb·2021-06-02·CVSS 8.8
CVE-2020-13927 [HIGH] Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
---
# Exploit Title: Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution
# Date: 2021-06-02
# Exploit Author: Pepe Berba
# Vendor Homepage: https://airflow.apache.org/
# Software Link: https://airflow.apache.org/docs/apache-airflow/stable/installation.html
# Version: <= 1.10.10
# Tested on: Docker apache/airflow:1.10 .10 (https://github.com/pberba/CVE-2020-11978/blob/main/docker-compose.yml)
# CVE : CVE-2020-11978
#
# This is a proof of concept for CVE-2020-11978, a RCE vulnerability in one of the example DAGs shipped with airflow
# This combines with CVE-2020-13927 where unauthenticated requests to Airflow's Experimental API were allowded by default.
# Together, potentially allows unauthenticated RCE to Airflow
#
# Re
Nuclei
Airflow Experimental <1.10.11 - REST API Auth Bypass
nuclei·CVSS 9.8
CVE-2020-13927 [CRITICAL] Airflow Experimental <1.10.11 - REST API Auth Bypass
Airflow Experimental <1.10.11 - REST API Auth Bypass
Airflow's Experimental API prior 1.10.11 allows all API requests without authentication.
Template:
id: CVE-2020-13927
info:
name: Airflow Experimental <1.10.11 - REST API Auth Bypass
author: pdteam
severity: critical
description: |
Airflow's Experimental API prior 1.10.11 allows all API requests without authentication.
impact: |
Allows unauthorized access to Airflow Experimental REST API
remediation: |
From Airflow 1.10.11 forward, the default has been changed to deny all requests by default. Note - this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide linked in the references.
reference:
- https://list
Metasploit
Apache Airflow 1.10.10 - Example DAG Remote Code Execution
metasploit·CVSS 8.8
CVE-2020-11978 [HIGH] Apache Airflow 1.10.10 - Example DAG Remote Code Execution
Apache Airflow 1.10.10 - Example DAG Remote Code Execution
This module exploits an unauthenticated command injection vulnerability by combining two critical vulnerabilities in Apache Airflow 1.10.10. The first, CVE-2020-11978, is an authenticated command injection vulnerability found in one of Airflow's example DAGs, "example_trigger_target_dag", which allows any authenticated user to run arbitrary OS commands as the user running Airflow Worker/Scheduler. The second, CVE-2020-13927, is a default setting of Airflow 1.10.10 that allows unauthenticated access to Airflow's Experimental REST API to perform malicious actions such as creating the vulnerable DAG above. The two CVEs taken together allow vulnerable DAG creation and command injection, leading to unauthenticated remote code execution
arXiv
SecScore: Enhancing the CVSS Threat Metric Group with Empirical Evidences
arxiv_fulltext·2024-05-14
SecScore: Enhancing the CVSS Threat Metric Group with Empirical Evidences
: Enhancing the CVSS Threat Metric Group with Empirical Evidences
Miguel Santana
Banco de PortugalPortugal
Vinicius V. Cogo
LASIGE, Informática, Faculdade de Ciências, Universidade de LisboaPortugal
Alan Oliveira de Sá
LASIGE, Informática, Faculdade de Ciências, Universidade de LisboaPortugal
printfolios=true
## Abstract
Background: Timely prioritising and remediating vulnerabilities are paramount in the dynamic cybersecurity field, and one of the most widely used vulnerability scoring systems (CVSS) does not address the increasing likelihood of emerging an exploit code.
Aims: We present , an innovative vulnerability severity score that enhances CVSS Threat metric group with statistical models from empirical evidences of real-world exploit codes.
Method: adjusts the traditional
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Unit42
Network Security Trends: May-July 2021
blogs_unit42·2021-09-17
Network Security Trends: May-July 2021
## Executive Summary
Unit 42 researchers continue to observe network security trends, tracking how cybercriminals take advantage of vulnerabilities in the real world. The following sections present our analysis of the most recently published vulnerabilities, including their severity and category distribution. Additionally, we provide insight into how the vulnerabilities are exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls. We highlight vulnerabilities ranked medium severity and above that were newly published from May-July 2021 in order to raise awareness of their active exploits in the wild. We then draw conclusions about the most commonly exploited vulnerabilities we observed attackers using, as well as the severity, category and
Unit42
Network Security Trends: May-July 2021
blogs_unit42·2021-09-17
Network Security Trends: May-July 2021
Threat Research Center
Trend Reports
Vulnerabilities
## Network Security Trends: May-July 2021
Yue Guan
Lei Xu
Published: September 17, 2021
Malware
Trend Reports
Vulnerabilities
Attack analysis
Exploit
Exploit in the wild
Network security trends
## Executive Summary
Unit 42 researchers continue to observe network security trends, tracking how cybercriminals take advantage of vulnerabilities in the real world. The following sections present our analysis of the most recently published vulnerabilities, including their severity and category distribution. Additionally, we provide insight into how the vulnerabilities are exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls . We highlight vulnerabilities ranked medium sever
CWE
Missing Authentication for Critical Function
mitre_cwe
CWE-306 Missing Authentication for Critical Function
CWE-306: Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Modes of Introduction:
Phase: Architecture and Design
Note: OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Phase: Architecture and Design
Note: Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will conne
CWE
Improper Authentication
mitre_cwe
CWE-287 Improper Authentication
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Note: REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Common Consequences:
Scope: Integrity, Confidentiality, Availability, Access Control. Impact: Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands. This weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code.
Detection Methods:
Automated Static Analysis: Automated static analysis is useful for de
CWE
Improper Access Control
mitre_cwe
CWE-284 Improper Access Control
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Access control involves the use of several protection mechanisms such as: Authentication (proving the identity of an actor) Authorization (ensuring that a given actor can access a resource), and Accountability (tracking of activities that were performed) When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. There are two distinct behaviors that can introduce access control weaknesses: Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the reso
http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.htmlhttps://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3Ehttp://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.htmlhttps://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3Ehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13927
2020-11-10
Published
2022-01-18
Added to CISA KEV
Exploited in the wild