PyPI: apache-airflow
CVE-2020-13927
Safety vulnerability ID: SFTY-20201110-18589
Safety legacy ID: pyup.io-54436
Affected versions of the Apache Airflow package are vulnerable to Missing Authentication for Critical Function due to an insecure default configuration that permits unauthenticated requests to the Experimental API. In versions before 1.10.11, the web server exposes endpoints under /api/experimental/ without enforcing an authentication backend, allowing arbitrary clients to invoke operations such as POST /api/experimental/dags/<dag_id>/dag_runs.
Overview
Authentication bypass in Apache Airflow
Advisory
Affected versions of the Apache Airflow package are vulnerable to Missing Authentication for Critical Function due to an insecure default configuration that permits unauthenticated requests to the Experimental API. In versions before 1.10.11, the web server exposes endpoints under /api/experimental/ without enforcing an authentication backend, allowing arbitrary clients to invoke operations such as POST /api/experimental/dags/<dag_id>/dag_runs.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20201110-18589/CVE-2020-13927
- https://nvd.nist.gov/vuln/detail/CVE-2020-13927
- https://airflow.apache.org/docs/apache-airflow/1.10.11/security.html#api-authentication
- https://github.com/apache/airflow/releases/tag/1.10.11
- https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E
- http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html
- https://github.com/apache/airflow/commit/180bca4f993b7b778a8d2c65d3d357652218922b
- https://github.com/apache/airflow/commit/9e305d6b810a2a21e2591a80a80ec41acb3afed0
- https://github.com/apache/airflow/pull/9611
- https://github.com/advisories/GHSA-hhx9-p69v-cx2j
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-18.yaml
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13927
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more