Unauthenticated Airflow Instance

What is the "Unauthenticated Airflow Instance?"

The "Unauthenticated Airflow Instance" module is designed to detect misconfigurations in Apache Airflow instances. Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. This module focuses on identifying instances that allow unauthenticated access, which poses a high severity risk to the system's security.

This module was authored by dhiyaneshDK.

Impact

An unauthenticated Airflow instance can lead to unauthorized access and potential data breaches. Attackers can exploit this vulnerability to gain control over the system, execute arbitrary code, and access sensitive information. It is crucial to address this issue promptly to prevent any security incidents.

How the module works?

The "Unauthenticated Airflow Instance" module works by sending an HTTP GET request to the "/admin/" path of the target system. It then applies matching conditions to determine if the instance is vulnerable. The matching conditions include:

- Body Matcher: The module checks if the response body contains the HTML title tag "<title>Airflow - DAGs</title>". - Status Matcher: The module verifies if the HTTP response status code is 200 (OK).

If both matching conditions are met, the module reports a vulnerability, indicating that the Airflow instance is unauthenticated.

It is important to note that this module is just one test case used within the Vidoc platform to perform scanning and identify potential security risks.