Jens Scheffler

يوجد عيب في Airflow حيث يمكن أن يكشف تقرير أخطاء واجهة المستخدم (UI) عن معلومات حساسة يتم تمريرها كمعلمات الكلمات الرئيسية (`kwargs`) إلى المشغلات عند فشل الرسم البياني الموجه غير الدوري (DAG) أثناء التحليل. كان هذا الكشف مقصورًا على المستخدمين المصادق عليهم الذين لديهم إذن لعرض DAG المتأثر. قد تؤدي هذه المشكلة إلى الكشف عن أسرار أو قيم حساسة أخرى مضمنة في `kwargs`.

The issue is related to the use of web browser cache containing sensitive information in Apache Airflow. Airflow did not return a "Cache-Control" header for dynamic content, which could result in potentially storing sensitive data in the local cache of the browser. This could allow an attacker to disclose protected information through the Cache-Control header.

The issue allows an authenticated attacker to inject malicious data into the task instance logs. This is a critical security vulnerability that enables attackers to inject data into the task instance logs.

The issue is related to a stored XSS vulnerability that allows a DAG author to add unbounded and not-sanitized JavaScript in the parameter description field of the DAG. This JavaScript can be executed on the client side of any user who looks at the tasks in the browser sandbox, allowing modification of what the user sees in the browser. This opens up possibilities of misleading other users.

The issue is related to insufficient authentication of executed requests in Apache Airflow, allowing an attacker to trigger a DAG in a GET request without CSRF validation. This could enable a malicious website opened in the same browser as the Airflow UI to trigger the execution of DAGs without the user's consent.