Summary
Apache Airflow's AWS authentication manager does not properly bind a SAML authentication response to the browser session that initiated the login. An attacker who controls a page can cause a victim's browser to sign in to the attacker's Airflow account, potentially causing the victim's subsequent actions to be recorded in a session controlled by the attacker.
Apache Airflow's AWS authentication manager does not properly bind a SAML authentication response to the browser session that initiated the login. An attacker who controls a page can cause a victim's browser to sign in to the attacker's Airflow account, potentially causing the victim's subsequent actions to be recorded in a session controlled by the attacker.
Affected context
The issue affects deployments using the Apache Airflow Amazon provider's AWS authentication manager with SAML authentication. It occurs when the SAML login flow does not preserve the original authentication request identifier and the callback accepts an assertion without requiring a matching response binding.
The issue affects deployments using the Apache Airflow Amazon provider's AWS authentication manager with SAML authentication. It occurs when the SAML login flow does not preserve the original authentication request identifier and the callback accepts an assertion without requiring a matching response binding.
Exploit preconditions
- Attack surface: SAML login and callback endpoints exposed by an Airflow deployment
- Required access: No Airflow account or credentials are required for the attacker
- Victim condition: The victim must visit an attacker-controlled page while using a browser that can access the Airflow deployment
- Trigger point: The browser processes the attacker-induced SAML login flow
- Why exploitation is possible: The callback does not require the SAML response to reference the authentication request initiated by the victim's browser
- Attack surface: SAML login and callback endpoints exposed by an Airflow deployment
- Required access: No Airflow account or credentials are required for the attacker
- Victim condition: The victim must visit an attacker-controlled page while using a browser that can access the Airflow deployment
- Trigger point: The browser processes the attacker-induced SAML login flow
- Why exploitation is possible: The callback does not require the SAML response to reference the authentication request initiated by the victim's browser
Why this happens
The authentication flow discards the SAML AuthnRequest identifier and fails to enforce a matching InResponseTo value when processing the assertion. This breaks the relationship between the browser that initiated authentication and the response that completes it, allowing an attacker-supplied login response to be accepted in another user's browser. The behavior maps to CWE-352: Cross-Site Request Forgery, specifically a login-CSRF condition.
The authentication flow discards the SAML AuthnRequest identifier and fails to enforce a matching InResponseTo value when processing the assertion. This breaks the relationship between the browser that initiated authentication and the response that completes it, allowing an attacker-supplied login response to be accepted in another user's browser. The behavior maps to CWE-352: Cross-Site Request Forgery, specifically a login-CSRF condition.
Potential impact
- The victim may be silently logged into the attacker's Airflow account
- Actions performed by the victim may be recorded in a session controlled by the attacker
- Sensitive information entered or generated during the session could be exposed to the attacker
- Operational changes may be attributed to the wrong account
- Workflow or administrative activity could be performed under unintended account context
- The victim may be silently logged into the attacker's Airflow account
- Actions performed by the victim may be recorded in a session controlled by the attacker
- Sensitive information entered or generated during the session could be exposed to the attacker
- Operational changes may be attributed to the wrong account
- Workflow or administrative activity could be performed under unintended account context
General mitigation guidance
Mitigation generally focuses on binding every SAML response to the authentication transaction that initiated it.
Common defensive patterns include:
- Preserve an unpredictable, single-use AuthnRequest identifier for the complete login flow
- Require a valid matching
InResponseTovalue before accepting a SAML assertion - Expire and invalidate authentication state after successful or failed completion
- Apply same-site, secure, and appropriately scoped cookie protections
- Use explicit confirmation or reauthentication for sensitive account-context changes
- Limit session privileges and separate authentication from authorization decisions
Mitigation generally focuses on binding every SAML response to the authentication transaction that initiated it.
Common defensive patterns include:
- Preserve an unpredictable, single-use AuthnRequest identifier for the complete login flow
- Require a valid matching
InResponseTovalue before accepting a SAML assertion - Expire and invalidate authentication state after successful or failed completion
- Apply same-site, secure, and appropriately scoped cookie protections
- Use explicit confirmation or reauthentication for sensitive account-context changes
- Limit session privileges and separate authentication from authorization decisions
How teams detect issues like this
Organizations can assess this issue through:
- Static analysis and code review checks for SAML callbacks that omit
InResponseTovalidation - Tests that attempt to complete a login with a response created for a different browser or request
- Review of authentication state handling, including request identifiers, expiration, and single-use enforcement
- Monitoring for unusual login sequences, mismatched request and response identifiers, or unexpected account-context changes
- Policy enforcement requiring state binding for SAML, OAuth, and other browser-based authentication flows
Automated security review tools may help identify missing CSRF-state validation, but runtime tests should verify the complete identity-binding behavior.
Organizations can assess this issue through:
- Static analysis and code review checks for SAML callbacks that omit
InResponseTovalidation - Tests that attempt to complete a login with a response created for a different browser or request
- Review of authentication state handling, including request identifiers, expiration, and single-use enforcement
- Monitoring for unusual login sequences, mismatched request and response identifiers, or unexpected account-context changes
- Policy enforcement requiring state binding for SAML, OAuth, and other browser-based authentication flows
Automated security review tools may help identify missing CSRF-state validation, but runtime tests should verify the complete identity-binding behavior.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| lists. | lists.apache.org/ |
| cve. | cve.org/ |
