BIT-airflow-2023-37379
Denial of Service vulnerability in apache-airflow (PyPI)
What is BIT-airflow-2023-37379 About?
This vulnerability in Apache Airflow allows an authenticated user with Connection edit privileges to trigger a Denial of Service (DoS). By repeatedly exploiting the test connection feature, the attacker can overload the server. Additionally, this allows malicious actors to establish harmful connections to the server.
Affected Software
- apache-airflow
- <2.7.0
- <2.7.0b1
Technical Details
The vulnerability in Apache Airflow (versions prior to 2.7.0) involves an authenticated user possessing 'Connection edit privileges' abusing the 'test connection' feature. This feature, when invoked repeatedly or with specially crafted connection parameters (e.g., pointing to a resource that responds slowly or exhausts server resources), can lead to a denial of service. The ability to define and test arbitrary connections also allows an attacker to establish harmful connections, potentially to internal or external malicious resources, which can contribute to the DoS or facilitate further attacks.
What is the Impact of BIT-airflow-2023-37379?
Successful exploitation may allow attackers to disrupt the availability of the Apache Airflow server, prevent legitimate users from accessing services, and potentially establish unauthorized or malicious network connections.
What is the Exploitability of BIT-airflow-2023-37379?
Exploitation of this vulnerability is of medium complexity. It requires the attacker to be authenticated and possess specific privileges (Connection edit privileges). This is a remote vulnerability that can be exploited by sending multiple requests to the server. The key condition is having the 'Connection edit' privilege, which allows for the creation and testing of connections. The likelihood of exploitation increases in environments where this privilege is broadly assigned or where inactive accounts with such privileges are not promptly revoked.
What are the Known Public Exploits?
| PoC Author | Link | Commentary |
|---|---|---|
| No known exploits | ||
What are the Available Fixes for BIT-airflow-2023-37379?
Available Upgrade Options
- apache-airflow
- <2.7.0b1 → Upgrade to 2.7.0b1
- apache-airflow
- <2.7.0 → Upgrade to 2.7.0
Struggling with dependency upgrades?
See how Resolved Security's drop-in replacements make it simple.
Book a demoAdditional Resources
- https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r
- http://www.openwall.com/lists/oss-security/2023/08/23/4
- https://osv.dev/vulnerability/PYSEC-2023-152
- https://github.com/apache/airflow/pull/32052
- https://nvd.nist.gov/vuln/detail/CVE-2023-37379
- https://github.com/apache/airflow
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-152.yaml
- https://github.com/apache/airflow/pull/32052
- https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r
- http://www.openwall.com/lists/oss-security/2023/08/23/4
What are Similar Vulnerabilities to BIT-airflow-2023-37379?
Similar Vulnerabilities: CVE-2022-40157 , CVE-2023-44487 , CVE-2023-45811 , CVE-2023-35805 , CVE-2022-23588
