CVE-2022-24288
published 2022-02-25CVE-2022-24288: In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection…
PriorityP187high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
77.88%
99.5th percentile
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | < 2.2.4 | 2.2.4 |
| apache_software_foundation | apache_airflow | >= unspecified < 2.2.4 | 2.2.4 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by matching the vulnerable DAG ID 'example_passing_params_via_test_command' in HTTP requests to the Airflow trigger or code endpoints ↗
- →Detect exploitation attempts by matching the vulnerable DAG ID 'tutorial' in HTTP POST requests to the Airflow trigger endpoint, combined with JSON body containing 'my_param' key ↗
- →Alert on HTTP responses from Airflow containing the unrendered Jinja2 template string indicating an unauthenticated/vulnerable instance ↗
- →Detect OS command injection payloads in Airflow DAG trigger POST bodies: look for semicolons and shell metacharacters within JSON param values (e.g., params containing '";' sequences) ↗
- →Monitor for reverse shell patterns (e.g., bash -i >& /dev/tcp/) in Airflow DAG trigger request bodies targeting the foo or my_param parameters ↗
- →Use Shodan/FOFA queries to identify exposed Airflow instances: match on page title 'sign in - airflow' or HTML containing 'Apache Airflow' ↗
- ·The vulnerability only exists when example DAGs are loaded. Instances with '[core] load_examples = False' in their Airflow configuration are NOT affected. ↗
- ·The impact is significantly elevated when Airflow is configured for unauthenticated access, as exploitation requires no credentials in that case. ↗
- ·Two separate vulnerable DAGs are affected: 'example_passing_params_via_test_command.py' (params: foo, MIFF) and 'tutorial.py' (param: my_param), both assigned the same CVE. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OS Command injection in Apache Airflow
ghsa·2022-02-26
CVE-2022-24288 [HIGH] CWE-78 OS Command injection in Apache Airflow
OS Command injection in Apache Airflow
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
OSV
OS Command injection in Apache Airflow
osv·2022-02-26
CVE-2022-24288 [HIGH] OS Command injection in Apache Airflow
OS Command injection in Apache Airflow
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
OSV
CVE-2022-24288: In Apache Airflow, prior to version 2
osv·2022-02-25
CVE-2022-24288 CVE-2022-24288: In Apache Airflow, prior to version 2
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
VulnCheck
Apache Airflow Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2022·CVSS 8.8
CVE-2022-24288 [HIGH] Apache Airflow Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Apache Airflow Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
Affected: Apache Airflow
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-08&host_type=src&vulnerability=cve-2022-24288; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-03&host_type=src&vulnerability=cve-2022-24288; https://dashboard.shadowserver.org/statistic
No detection rules found.
Nuclei
Apache Airflow OS Command Injection
nuclei·CVSS 8.8
CVE-2022-24288 [HIGH] Apache Airflow OS Command Injection
Apache Airflow OS Command Injection
Apache Airflow prior to version 2.2.4 is vulnerable to OS command injection attacks because some example DAGs do not properly sanitize user-provided parameters, making them susceptible to OS Command Injection from the web UI.
Template:
id: CVE-2022-24288
info:
name: Apache Airflow OS Command Injection
author: xeldax
severity: high
description: Apache Airflow prior to version 2.2.4 is vulnerable to OS command injection attacks because some example DAGs do not properly sanitize user-provided parameters, making them susceptible to OS Command Injection from the web UI.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the target system.
remediation: |
Apply the latest security patches or upgr
2022-02-25
Published
Exploited in the wild