Summary
A command injection vulnerability in Apache Airflow's SSH provider allows shell syntax in templated environment values to execute on the remote SSH host. The issue becomes risky when a user who can trigger a DAG can supply input such as params or dag_run.conf that is passed into the operator's environment parameter.
A command injection vulnerability in Apache Airflow's SSH provider allows shell syntax in templated environment values to execute on the remote SSH host. The issue becomes risky when a user who can trigger a DAG can supply input such as params or dag_run.conf that is passed into the operator's environment parameter.
Affected context
The vulnerability occurs in Airflow deployments using the SSHRemoteJobOperator with an SSH provider version that incorrectly quotes templated environment values. Risk is present when DAGs pass trigger-time or otherwise user-controlled data into the operator's environment parameter and the resulting wrapper script is executed on a remote SSH host.
The vulnerability occurs in Airflow deployments using the SSHRemoteJobOperator with an SSH provider version that incorrectly quotes templated environment values. Risk is present when DAGs pass trigger-time or otherwise user-controlled data into the operator's environment parameter and the resulting wrapper script is executed on a remote SSH host.
Exploit preconditions
- Attack surface: An Airflow DAG using SSHRemoteJobOperator and a remote SSH connection
- Required access: Permission to trigger the affected DAG, without requiring DAG-authoring privileges
- Trigger point: Rendering and execution of the remote wrapper script
- Input condition: User-controlled values from sources such as
paramsordag_run.confmust flow into the templatedenvironmentparameter - Why exploitation is possible: Values are quoted only once even though they are inserted into an already-quoted shell wrapper, allowing shell command-substitution syntax to be interpreted remotely
- Attack surface: An Airflow DAG using SSHRemoteJobOperator and a remote SSH connection
- Required access: Permission to trigger the affected DAG, without requiring DAG-authoring privileges
- Trigger point: Rendering and execution of the remote wrapper script
- Input condition: User-controlled values from sources such as
paramsordag_run.confmust flow into the templatedenvironmentparameter - Why exploitation is possible: Values are quoted only once even though they are inserted into an already-quoted shell wrapper, allowing shell command-substitution syntax to be interpreted remotely
Why this happens
The underlying bug is incomplete shell escaping of templated data. The operator places environment values inside a quoted wrapper script but applies quoting only once, leaving specially crafted shell syntax capable of being interpreted by the remote shell.
This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because data supplied through a templated parameter can cross the boundary into command interpretation.
The underlying bug is incomplete shell escaping of templated data. The operator places environment values inside a quoted wrapper script but applies quoting only once, leaving specially crafted shell syntax capable of being interpreted by the remote shell.
This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, because data supplied through a templated parameter can cross the boundary into command interpretation.
Potential impact
- An attacker may execute arbitrary commands on the remote host
- Commands could run with the privileges of the SSH connection user
- Sensitive files, credentials, or application data could be accessed
- The remote host may be modified or used for lateral movement
- Airflow workflows or downstream systems could be disrupted
- An attacker may execute arbitrary commands on the remote host
- Commands could run with the privileges of the SSH connection user
- Sensitive files, credentials, or application data could be accessed
- The remote host may be modified or used for lateral movement
- Airflow workflows or downstream systems could be disrupted
General mitigation guidance
Mitigation generally focuses on preventing untrusted values from becoming shell-interpreted content.
Common defensive patterns include:
- Apply the vendor's security fix through the organization's normal dependency-management process
- Avoid passing trigger-time or user-controlled input directly into shell-sensitive environment values
- Use structured execution interfaces that do not construct commands through shell interpolation
- Apply context-appropriate escaping at the final command boundary, rather than relying only on earlier templating
- Restrict which users can trigger sensitive DAGs and limit the privileges of SSH connection accounts
- Store credentials separately from templated workflow inputs and avoid exposing them to remote command environments
Mitigation generally focuses on preventing untrusted values from becoming shell-interpreted content.
Common defensive patterns include:
- Apply the vendor's security fix through the organization's normal dependency-management process
- Avoid passing trigger-time or user-controlled input directly into shell-sensitive environment values
- Use structured execution interfaces that do not construct commands through shell interpolation
- Apply context-appropriate escaping at the final command boundary, rather than relying only on earlier templating
- Restrict which users can trigger sensitive DAGs and limit the privileges of SSH connection accounts
- Store credentials separately from templated workflow inputs and avoid exposing them to remote command environments
How teams detect issues like this
Detection can combine dependency analysis with workflow and code review controls:
- Identify affected SSH provider dependency ranges in lockfiles and deployment manifests
- Search DAG source for SSHRemoteJobOperator usage with templated
environmentvalues - Trace
params,dag_run.conf, API inputs, or other user-controlled data into shell-facing operator fields - Review wrapper-script construction and escaping behavior at the final remote execution boundary
- Use static analysis or automated review rules to flag shell interpolation, command substitution, and untrusted template data
- Enforce workflow policies that restrict trigger permissions for DAGs invoking privileged remote hosts
Detection can combine dependency analysis with workflow and code review controls:
- Identify affected SSH provider dependency ranges in lockfiles and deployment manifests
- Search DAG source for SSHRemoteJobOperator usage with templated
environmentvalues - Trace
params,dag_run.conf, API inputs, or other user-controlled data into shell-facing operator fields - Review wrapper-script construction and escaping behavior at the final remote execution boundary
- Use static analysis or automated review rules to flag shell interpolation, command substitution, and untrusted template data
- Enforce workflow policies that restrict trigger permissions for DAGs invoking privileged remote hosts
Sources
| Source | Link |
|---|---|
| airflow. | airflow.apache.org/ |
| github. | github.com/ |
| lists. | lists.apache.org/ |
| openwall. | openwall.com/ |
