# CVE-2020-11978:  Remote code execution in Apache Airflow's Example DAGs

## Information
**Description:** This vulnerability allows RCE when Airflow's example DAGs are loaded, potentially unauthenticated with CVE-2020-13927  
**CVE Credit**: xuxiang of DtDream security   
**Versions Affected:** <1.10.11  
**Disclosure Link:** https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E  
**NIST CVE Link:** https://nvd.nist.gov/vuln/detail/CVE-2020-11978  

## Proof-of-Concept Exploit
### Description

This exploits the example DAG that is vulnerable to command injection along using the experimental REST API that is public by default, even if web interface has authentication set.

### Usage/Exploitation
`python CVE-2020-11978.py <url> <command>`


### On CVE-2020-13927

If `example_trigger_target_dag` is not loaded and you have knowledge of the particular DAG you want to trigger, then you can use `CVE-2020-11978-min.py` as a template on how to trigger that specific DAG.

## Remediation

### Remove Example DAGs

If you already have examples disabled by setting `load_examples=False` in the config then you are not vulnerable. 

You can update to `>=1.10.11` or remove the vulnerable DAG is `example_trigger_target_dag` for `<1.10.11`

### Deny access to experimental API

If you start a new Airflow instance using `>=1.10.11` , then `deny_all` is already set for `auth_backend` by default in `airflow.cfg`.

```
[api]
auth_backend = airflow.api.auth.backend.deny_all
```

Note that `airflow.api.auth.backend.default` still allows unauthenticated requests to the API even for `>=1.10.11`. So if you have an existing Airflow instance which `auth_backend = airflow.api.auth.backend.default` then even after upgrading to  `>=1.10.11`, then the REST API is still public.

For `>=2.0.0`, the experimental API is disabled but has a more powerful stable API.