CVE-2020-17526
published 2020-12-21CVE-2020-17526: Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log…
PriorityP264high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EXPLOIT
EPSS
23.34%
97.5th percentile
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | < 1.10.14 | 1.10.14 |
| apache_software_foundation | apache_airflow | >= Apache Airflow < 1.10.14 | 1.10.14 |
Detection & IOCsextracted from sources · hover to see the quote
cookiesession=.eJwlzUEOwiAQRuG7zLoLpgMM9DIE6D-xqdEEdGW8u03cvy_vQ8UG5o02q_eJhcqx00YdDaKao6p5ZZe89ZyFUaPExqCF-hxWXs8Tj6tXt_rGnKpxC6vviTNiELBxErerBBZk9Zd7T4z_hOn7A0cWI94.YwJ5bw.LzJjDflCTQE2BfJ7kXcsOi49vvY
url/admin/
otherhttp.title:"airflow - dags" || http.html:"apache airflow"
otherhttp.title:"sign in - airflow"
otherintitle:"sign in - airflow"
otherintitle:"airflow - dags" || http.html:"apache airflow"
- →Exploit sends a GET request to /admin/ with a forged session cookie from a different Airflow site; successful bypass is indicated by HTTP 302 redirect followed by a response body containing Airflow dashboard keywords.
- →Successful authentication bypass confirmed when response body contains all of: 'DAG', 'Recent Tasks', 'Users', 'SLA Misses', 'Task Instances'.
- →First request to /admin/ should return HTTP 302 with body containing 'Redirecting...' as a prerequisite indicator before the session replay attempt.
- →Vulnerability only affects instances using the default [webserver] secret_key config; instances with a changed secret_key are not affected. ↗
- ·The authentication bypass only works when the Airflow Webserver is running with the default [webserver] secret_key configuration value. Changing this key to a unique, site-specific value prevents cross-site session reuse. ↗
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Incorrect Session Validation in Apache Airflow
ghsa·2021-04-20
CVE-2020-17526 [HIGH] CWE-269 Incorrect Session Validation in Apache Airflow
Incorrect Session Validation in Apache Airflow
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
OSV
Incorrect Session Validation in Apache Airflow
osv·2021-04-20
CVE-2020-17526 [HIGH] Incorrect Session Validation in Apache Airflow
Incorrect Session Validation in Apache Airflow
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
OSV
CVE-2020-17526: Incorrect Session Validation in Apache Airflow Webserver versions prior to 1
osv·2020-12-21
CVE-2020-17526 CVE-2020-17526: Incorrect Session Validation in Apache Airflow Webserver versions prior to 1
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
No detection rules found.
Nuclei
Apache Airflow <1.10.14 - Authentication Bypass
nuclei·CVSS 7.7
CVE-2020-17526 [HIGH] Apache Airflow <1.10.14 - Authentication Bypass
Apache Airflow <1.10.14 - Authentication Bypass
Apache Airflow prior to 1.10.14 contains an authentication bypass vulnerability via incorrect session validation with default configuration. An attacker on site A can access unauthorized Airflow on site B through the site A session.
Template:
id: CVE-2020-17526
info:
name: Apache Airflow <1.10.14 - Authentication Bypass
author: piyushchhiroliya
severity: high
description: |
Apache Airflow prior to 1.10.14 contains an authentication bypass vulnerability via incorrect session validation with default configuration. An attacker on site A can access unauthorized Airflow on site B through the site A session.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information or unauthorized execution
http://www.openwall.com/lists/oss-security/2020/12/21/1https://lists.apache.org/thread.html/r466759f377651f0a690475d5a52564d0e786e82c08d5a5730a4f8352%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3Ehttp://www.openwall.com/lists/oss-security/2020/12/21/1https://lists.apache.org/thread.html/r466759f377651f0a690475d5a52564d0e786e82c08d5a5730a4f8352%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E
2020-12-21
Published