apache airflow mongo हुक में अनुचित प्रमाणपत्र सत्यापन (Improper Certificate Validation in apache airflow mongo hook)

The primary impact of this vulnerability is the potential for man-in-the-middle (MITM) attacks. Because certificate validation is bypassed, an attacker can intercept and potentially modify data transmitted between Apache Airflow and the MongoDB server. This could lead to data breaches, unauthorized access to sensitive information, and even the injection of malicious code into the database. The blast radius extends to any data processed by Airflow that relies on the Mongo Hook, potentially impacting critical business operations and regulatory compliance.

Organizations using Apache Airflow to manage data pipelines and interacting with MongoDB databases are at risk, particularly those relying on the apache-airflow-providers-mongo package. Environments where SSL is enabled for Mongo connections without proper certificate validation are especially vulnerable. Shared hosting environments utilizing Airflow and MongoDB should be prioritized for remediation.

• python / airflow:

import airflow
from airflow.providers.mongo.hooks.mongo import MongoHook

# Check for allow_insecure setting in Airflow connections
for conn_id in airflow.configuration.get('connections'):
    hook = MongoHook(conn_id=conn_id)
    if hasattr(hook.conn, 'extra_defo'):
        if 'allow_insecure' in hook.conn.extra_defo and hook.conn.extra_defo['allow_insecure'] == True:
            print(f"VULNERABLE: Connection {conn_id} has allow_insecure enabled.")

1. 2024-02-20Disclosure

   disclosure

1. आरक्षित2024-02-06
2. प्रकाशित2024-02-20
3. संशोधित2025-05-01
4. EPSS अद्यतन2026-04-02

The recommended mitigation is to upgrade to Apache Airflow Providers Mongo version 4.0.0, which resolves this issue. If upgrading is not immediately feasible, consider disabling SSL for the Mongo Hook connection. Alternatively, enforce certificate validation by explicitly configuring the sslcertfile and sslkeyfile parameters in your Airflow connection settings. Review Airflow connection configurations to ensure SSL is properly configured and certificate validation is enabled. After upgrade, confirm by verifying that the allow_insecure setting is no longer present in the Mongo Hook configuration.