CVE-2022-43982
Cross-Site Scripting (XSS) vulnerability in apache-airflow (PyPI)
What is CVE-2022-43982 About?
This is a Cross-Site Scripting (XSS) vulnerability in Apache Airflow's 'Trigger DAG with config' screen, exploitable via the 'origin' query argument. An attacker can inject malicious scripts into the web page viewed by other users. The vulnerability is relatively easy to exploit, requiring only a crafted URL.
Affected Software
- apache-airflow
- <2.4.2rc1
- <2.4.2
Technical Details
The vulnerability is a reflected Cross-Site Scripting (XSS) attack in Apache Airflow versions prior to 2.4.2. It specifically affects the 'Trigger DAG with config' screen. The application fails to properly sanitize or encode the origin query argument before it is rendered on the web page. An attacker can craft a URL containing malicious script in the origin parameter. When a victim clicks this malicious link, their browser executes the injected script in the context of the Airflow application, leading to XSS.
What is the Impact of CVE-2022-43982?
Successful exploitation may allow attackers to execute arbitrary scripts in the victim's browser, steal session cookies, deface web content, or redirect users to malicious sites, potentially leading to unauthorized access or data theft.
What is the Exploitability of CVE-2022-43982?
Exploitation of this XSS vulnerability is of low complexity. It does not require authentication, but the attacker must trick a user into clicking a specially crafted URL. No special privileges are necessary. This is a remote vulnerability, as the crafted URL can be delivered via various remote communication channels. The primary risk factor is the lack of proper input validation and output encoding for the origin query parameter, making it susceptible to script injection.
What are the Known Public Exploits?
| PoC Author | Link | Commentary |
|---|---|---|
| No known exploits | ||
What are the Available Fixes for CVE-2022-43982?
Available Upgrade Options
- apache-airflow
- <2.4.2rc1 → Upgrade to 2.4.2rc1
- apache-airflow
- <2.4.2 → Upgrade to 2.4.2
Struggling with dependency upgrades?
See how Resolved Security's drop-in replacements make it simple.
Book a demoAdditional Resources
- https://github.com/apache/airflow/pull/27143
- https://osv.dev/vulnerability/GHSA-h63r-9xxf-f2c7
- https://osv.dev/vulnerability/PYSEC-2022-42970
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42970.yaml
- https://github.com/apache/airflow
- https://github.com/apache/airflow/commit/9fb4814d29d934cef3b02fb3b2547f9fb76aaa97
- https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l
- https://github.com/apache/airflow/pull/27143
- https://nvd.nist.gov/vuln/detail/CVE-2022-43982
- https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l
What are Similar Vulnerabilities to CVE-2022-43982?
Similar Vulnerabilities: CVE-2023-5047 , CVE-2023-4700 , CVE-2023-4699 , CVE-2023-4559 , CVE-2023-4558
