Fehlende Authentifizierung für kritische Funktion in Apache Airflow

The primary impact of CVE-2021-38540 is the potential for remote code execution. An attacker could leverage this vulnerability to inject malicious code into Airflow variables, which would then be executed as part of DAG runs. This could allow them to gain control of the Airflow infrastructure and potentially the underlying systems. The lack of authentication on the variable import endpoint makes exploitation relatively straightforward. Successful exploitation could lead to data breaches, system compromise, and disruption of critical workflows managed by Airflow. This vulnerability shares similarities with other insecure API endpoint exposures, where lack of authentication allows unauthorized access and manipulation of sensitive data or system functions.

Organizations heavily reliant on Apache Airflow for orchestrating complex workflows are at significant risk. Specifically, deployments with publicly accessible Airflow instances or those lacking robust network segmentation are particularly vulnerable. Airflow installations using older versions (prior to 2.1.3) and those with limited security monitoring are also at heightened risk.

• python / airflow:

import requests
import json

url = "http://<airflow_host>/api/v1/variables/import"
headers = {'Content-Type': 'application/json'}
data = {'key': 'test_variable', 'value': 'malicious_code'}

try:
    response = requests.post(url, headers=headers, data=json.dumps(data))
    print(f"Response Status Code: {response.status_code}")
    print(f"Response Content: {response.content}")
except requests.exceptions.RequestException as e:
    print(f"Error: {e}")

• linux / server: Monitor Airflow logs for unusual variable import activity or errors related to variable manipulation. Use journalctl -u airflow to filter for relevant log entries. • generic web: Check Airflow server access logs for requests to /api/v1/variables/import originating from unexpected IP addresses or user agents.

1. 2022-05-24Disclosure

   disclosure

2. 2022-05-24Patch

   patch

1. Reserviert2021-08-11
2. Veröffentlicht2022-05-24
3. Geändert2024-09-11
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2021-38540 is to upgrade Apache Airflow to version 2.1.3 or later, which includes the necessary authentication protections. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict network access to the variable import endpoint ( /api/v1/variables/import ) using a firewall or network segmentation. Implement a Web Application Firewall (WAF) rule to block unauthorized access to this endpoint. Carefully review and audit existing Airflow variables to identify any suspicious or unexpected values. After upgrading, confirm the fix by attempting to access the /api/v1/variables/import endpoint without authentication and verifying that access is denied.