地图 / CVE-2023-42663: Apache Airflow: Bypass permission verification to view task instances of other dags

CVE-2023-42663: Apache Airflow: Bypass permission verification to view task instances of other dags

访问控制 / Unlabeled / #2208656

厂商: Internet Bug Bounty
严重程度: 低危
赏金: $540
弱点: Unlabeled
研究员: @balis0ng
披露日期: 2023-11-13
资产: https://github.com/apache/airflow
CVE: CVE-2023-42663

该报告还没有中文解读。

原文摘录

摘自原文（1568 字符中的一小部分）

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.

原文中的代码

POST /api/v1/dags/~/dagRuns/~/taskInstances/list HTTP/1.1
Host: testvul.com:8080
Accept: application/json
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
content-type: application/json
Referer: …

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

2023-10-13报告提交
2023-11-13公开披露

阅读 HackerOne 原文 ↗作者 @balis0ng · 版权归作者与 Internet Bug Bounty 所有

同类报告

Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOShopify · 2020-04-01 [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationShopify · 2020-04-01 Broken Access Control leads to disclosure of transaction history via /v2/rechargeTransactionHistory endpointMTN Group · 2025-03-02 [Mail.Ru Android] Typo in permission name allows to write contacts without user knowledgeMail.ru · —Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise ServerGitHub · 2024-09-13 Improper State Validation on Sony WH-CH520 via BLE Command Service leads to unauthorized Bluetooth pairing and audio hijackingSony · —