EDB-49927

PoC

Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution

view exploit source exploit_dbtype webappsauthor Pepe Berbapublished 2021-06-02catalog exploit_db

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2020-13927US	critical9.8OT critical	99.8% (100th)	KEV	2020-11-10
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Ai…
CVE-2020-11978US	high8.8OT critical	99.2% (100th)	KEV	2020-07-17
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.