CVE-2024-25128: Apache Airlfow Vulnerability: custom, long deprecated OpenID (NOT OIDC)

[Jarek Potiuk <ja...@potiuk.com>]

CVE-2024-25128: Vulnerability in custom, long deprecated OpenID (NOT
OIDC) authentication method in Flask AppBuilder

Severity: moderate

Affected versions:
- Apache Airflow before 2.8.2

Description:

When Flask-AppBuilder configuration is set to ``AUTH_TYPE`` set to
``AUTH_OID``, it allows an attacker to forge an HTTP request that
could deceive the backend into using any requested OpenID service.

This vulnerability could grant an attacker unauthorised privilege
access if a custom OpenID service is deployed by the attacker and
accessible by the backend.

For more details and remediation, see the blog post here:
https://airflow.apache.org/blog/fab-oid-vulnerability/

Credit:
Islam Rzayev (finder)

References:

https://airflow.apache.org/
https://github.com/dpgaspar/Flask-AppBuilder/pull/2186
https://airflow.apache.org/blog/fab-oid-vulnerability/
https://www.cve.org/CVERecord?id=CVE-2024-25128

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@airflow.apache.org
For additional commands, e-mail: dev-help@airflow.apache.org