{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-13927/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-13927/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-13927/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-13927/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-13927/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-13927"},"sightings":{"href":"/api/v1/sightings/cve-2020-13927"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-13927.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2020-13927\n\ninfo:\n  name: Airflow Experimental <1.10.11 - REST API Auth Bypass\n  author: pdteam\n  severity: critical\n  description: |\n    Airflow's Experimental API prior 1.10.11 allows all API requests without authentication.\n  impact: |\n    Allows unauthorized access to Airflow Experimental REST API\n  remediation: |\n    From Airflow 1.10.11 forward, the default has been changed to deny all requests by default.  Note - this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide linked in the references.\n  reference:\n    - https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E\n    - http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html\n    - https://airflow.apache.org/docs/1.10.11/security.html#api-authenticatio\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-13927\n    - http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-13927\n    cwe-id: CWE-1188\n    epss-score: 0.99778\n    epss-percentile: 0.99955\n    cpe: cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: apache\n    product: airflow\n    shodan-query:\n      - title:\"Airflow - DAGs\" || http.html:\"Apache Airflow\"\n      - http.title:\"airflow - dags\" || http.html:\"apache airflow\"\n      - http.title:\"sign in - airflow\"\n      - product:\"redis\"\n    fofa-query:\n      - title=\"sign in - airflow\"\n      - apache airflow\n      - title=\"airflow - dags\" || http.html:\"apache airflow\"\n    google-query:\n      - intitle:\"sign in - airflow\"\n      - intitle:\"airflow - dags\" || http.html:\"apache airflow\"\n  tags: cve2020,cve,packetstorm,apache,airflow,unauth,auth-bypass,kev,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - '{{BaseURL}}/api/experimental/latest_runs'\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '\"dag_run_url\":'\n          - '\"dag_id\":'\n          - '\"items\":'\n        condition: and\n# digest: 4a0a004730450220165f55145ef3567c27324580454a737ab1629e399ea99f171cf769ea8d656dcc022100f8f603f768f2604dabee6a4749e56b864ace574ea15815160caf6b4a31060d8e:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-13927"}