CVE-2020-11978

Deeper analysis

CVE-2020-11978 is a remote code or command injection vulnerability present in Apache Airflow versions 1.10.10 and earlier. It resides in one of the example DAGs that ship with the product by default and stems from improper handling of untrusted input that is passed to operating-system commands, corresponding to CWE-78. The issue is absent when the configuration option load_examples is explicitly set to False.

Any authenticated user can exploit the flaw to execute arbitrary commands on the host running the Airflow worker or scheduler process, with privileges equivalent to that process. Successful exploitation therefore grants the attacker the ability to read, modify, or delete data and potentially pivot to other systems, depending on the executor configuration and the privileges of the Airflow service account.

Public advisories and exploit disclosures note that the sole recommended mitigation is to disable the example DAGs by setting load_examples=False in the Airflow configuration; no other configuration changes or patches are described for versions 1.10.10 and below. Multiple proof-of-concept exploits have been published that demonstrate unauthenticated-to-authenticated command execution against the vulnerable example DAG.