Incorrect Authorization Affecting apache-airflow-core package, versions [3.3.0,3.3.2rc1)

Affected versions of this package are vulnerable to Incorrect Authorization in JWTRefreshMiddleware's caller resolution, which resolves the caller from the session cookie and ignores an accompanying Authorization: Bearer token, inverting the intended precedence of bearer over cookie. An attacker can make a victim's requests execute, and be recorded in the audit log, as the attacker's principal rather than the identity the client explicitly presented, by first planting their own valid session cookie in the victim's browser or client through cookie tossing from a sibling subdomain, cross-site scripting in another application under a shared parent domain, or access to a shared workstation, which yields principal confusion and misattributed audit records rather than privilege escalation.

Prior to 3.3.0, the code path that caches the cookie-derived user was absent, and the cookie-planting step needs the Airflow UI to share a domain with other applications, leaving a deployment on a dedicated domain with nothing co-hosted unreachable this way.

• Apache Mailing List
• GitHub Commit
• GitHub PR
• GitHub PR