CVE-2022-45402

published 2022-11-15

CVE-2022-45402: In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.

Priority P3 45 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	airflow	< 2.4.3	2.4.3
apache_software_foundation	apache_airflow	>= unspecified < 2.4.3	2.4.3

Detection & IOCs extracted from sources · hover to see the quote

url http://127.0.0.1:8080/login/?next=/\google.com↗

• → Detect open redirect exploitation attempts against Apache Airflow login endpoint by monitoring for requests to `/login` where the `next` parameter contains a value starting with `/\` (forward-slash backslash), which browsers interpret as an absolute URL redirect. ↗
• → Monitor HTTP requests to the Airflow `/login` endpoint for a `next` query parameter whose value begins with `/\` — this bypasses open-redirect protections and causes browsers to treat the path as `http://` in the Location header. ↗
• → Flag any Airflow login requests where the `next` parameter contains a backslash character, as the validation logic in versions prior to 2.4.3 fails to reject such values. ↗

• · The vulnerability affects Apache Airflow versions prior to 2.4.3; upgrading to 2.4.3 or later remediates the open redirect in the `/login` endpoint. ↗
• · The fix was introduced via the referenced pull request; environments still running v2.4.2 or earlier remain exploitable. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-601