CVE-2017-17836

Vulnerability

In Apache Airflow 1.8.2 and earlier, an experimental feature exposed authenticated cookies and passwords for databases used by Airflow. The feature displayed these sensitive values in the Airflow web interface, making them accessible to any user or attacker who can view the UI under certain conditions. The affected versions are Apache Airflow 1.8.2 and earlier [2] [3].

Exploitation

An attacker who has limited access to the Airflow system can exploit this vulnerability. This access can be achieved through cross-site scripting (XSS) or by using an unlocked machine that is logged into the Airflow UI. No additional authentication is required beyond the initial access, as the vulnerable feature directly displays the credentials. The attacker simply navigates to the experimental feature's page to view and exfiltrate the exposed cookies and database passwords [2] [3].

Impact

Successful exploitation allows the attacker to exfiltrate all credentials from the system, including authenticated cookies and passwords to databases used by Airflow. This can lead to unauthorized access to the Airflow instance and connected databases, potentially compromising the integrity and confidentiality of workflows and data [2] [3].

Mitigation

Apache Airflow 1.9.0, released after the vulnerability was disclosed, resolves this issue by removing the experimental feature that exposed credentials. Users of affected versions should upgrade to Airflow 1.9.0 or later. No workaround is available for unfixed versions [2] [3].