Aaron
63285f61aa
Some checks failed
Vulhub Format Check and Lint / format-check (push) Has been cancelled
Vulhub Format Check and Lint / markdown-check (push) Has been cancelled
Vulhub Docker Image CI / longtime-images-test (push) Has been cancelled
Vulhub Docker Image CI / images-test (push) Has been cancelled
54 lines
1.6 KiB
Markdown
54 lines
1.6 KiB
Markdown
# Apache Airflow Celery Broker Remote Command Execution (CVE-2020-11981)
|
|
|
|
[中文版本(Chinese version)](README.zh-cn.md)
|
|
|
|
Apache Airflow is an open source, distributed task scheduling framework. In the version prior to 1.10.10, if the Redis broker (such as Redis or RabbitMQ) has been controlled by attacker, the attacker can execute arbitrary commands in the worker process.
|
|
|
|
Since there are many components to be started, it may be a bit stuck. Please prepare more than 2G of memory for the use of the virtual machine.
|
|
|
|
References:
|
|
|
|
- <https://lists.apache.org/thread/cn57zwylxsnzjyjztwqxpmly0x9q5ljx>
|
|
- <https://github.com/apache/airflow/pull/9178>
|
|
|
|
## Vulnerability Environment
|
|
|
|
Execute the following commands to start an airflow 1.10.10 server:
|
|
|
|
```bash
|
|
#Initialize the database
|
|
docker compose run airflow-init
|
|
|
|
#Start service
|
|
docker compose up -d
|
|
```
|
|
|
|
## Exploit
|
|
|
|
For exploit this vulnerability, you have to get the write permission of the Celery broker, Redis. In Vulhub environment, Redis port 6379 is exposing on the Internet.
|
|
|
|
Through the Redis, you can add the evil task `airflow.executors.celery_executor.execute_command` to the queue to execute arbitrary commands.
|
|
|
|
Use this script [exploit_airflow_celery.py](exploit_airflow_celery.py) to execute the command `touch /tmp/airflow_celery_success`
|
|
|
|
```
|
|
pip install redis
|
|
python exploit_airflow_celery.py [your-ip]
|
|
```
|
|
|
|
See the results on the logs:
|
|
|
|
```bash
|
|
docker compose logs airflow-worker
|
|
```
|
|
|
|
|
|
|
|
As you can see, `touch /tmp/airflow_celery_success` has been successfully executed:
|
|
|
|
```
|
|
docker compose exec airflow-worker ls -l /tmp
|
|
```
|
|
|
|
|