CVE-2021-38540
published 2021-09-09CVE-2021-38540: The variable import endpoint was not protected by authentication in Airflow >=2.0.0, =2.0.0, <2.1.3.
PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
80.94%
99.6th percentile
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, =2.0.0, <2.1.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | >= 2.0.0 < 2.1.3 | 2.1.3 |
| apache_software_foundation | apache_airflow | >= Apache Airflow < 2.1.3 | 2.1.3 |
Detection & IOCsextracted from sources · hover to see the quote
othercsrf_token extracted via regex: type="hidden" value="(.*?)">
- →The /variable/varimport endpoint accepts unauthenticated POST requests in Apache Airflow >=2.0.0, <2.1.3. Monitor for POST requests to this path without a valid session/auth header. ↗
- →Exploit chains a GET to /login to harvest a CSRF token (hidden field), then POSTs a variable import payload to /variable/varimport — detect two-step sequences from the same source IP hitting both paths.
- ·Vulnerability only affects Apache Airflow versions >=2.0.0 and <2.1.3; versions outside this range are not affected. ↗
- ·The exploit requires a valid CSRF token harvested from the /login page before the unauthenticated import POST will succeed; detection logic should account for this two-request pattern.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Missing Authentication for Critical Function in Apache Airflow
ghsa·2022-05-24
CVE-2021-38540 [CRITICAL] CWE-306 Missing Authentication for Critical Function in Apache Airflow
Missing Authentication for Critical Function in Apache Airflow
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, =2.0.0, <2.1.3.
OSV
Missing Authentication for Critical Function in Apache Airflow
osv·2022-05-24
CVE-2021-38540 [CRITICAL] Missing Authentication for Critical Function in Apache Airflow
Missing Authentication for Critical Function in Apache Airflow
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, =2.0.0, <2.1.3.
OSV
CVE-2021-38540: The variable import endpoint was not protected by authentication in Airflow >=2
osv·2021-09-09
CVE-2021-38540 CVE-2021-38540: The variable import endpoint was not protected by authentication in Airflow >=2
The variable import endpoint was not protected by authentication in Airflow >=2.0.0, =2.0.0, <2.1.3.
No detection rules found.
Nuclei
Apache Airflow - Unauthenticated Variable Import
nuclei·CVSS 9.8
CVE-2021-38540 [CRITICAL] Apache Airflow - Unauthenticated Variable Import
Apache Airflow - Unauthenticated Variable Import
Apache Airflow Airflow >=2.0.0 and =2.0.0 and '
extractors:
- type: regex
name: csrf
group: 1
regex:
- type="hidden" value="(.*?)">
internal: true
# digest: 4a0a004730450220116008754dfad511435ac949b86f87a4d5636d4c5d2d8483e714c68df76cf0ec022100c0d9346e2b42c554503e556885c6ba0c613bfbbd133cf8121b99c6a1f8b1888d:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
https://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/rac2ed9118f64733e47b4f1e82ddc8c8020774698f13328ca742b03a2%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rb34c3dd1a815456355217eef34060789f771b6f77c3a3dec77de2064%40%3Cusers.airflow.apache.org%3E
2021-09-09
Published