[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAH8yC8mupFZbaqAdBpdKDbU-R2DknH_hqdttcPDu394SXTCDjw@mail.gmail.com>
Date: Sun, 6 Apr 2025 18:59:14 -0400
From: Jeffrey Walton <noloader@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-30473: Apache Airflow Common SQL
Provider: Remote Code Execution via Sql Injection
On Sun, Apr 6, 2025 at 9:46 AM Hanno Böck <hanno@...eck.de> wrote:
>
> On Fri, 04 Apr 2025 18:54:21 +0000
> Elad Kalif <eladkal@...che.org> wrote:
>
> > https://github.com/apache/airflow/pull/48098
>
> If I read this code correctly, the only thing this PR changes is to
> reject inputs with an ";" character.
> I am not familiar with the codebase, and also by no means an expert in
> SQL injections. But I am pretty sure there are ways to exploit SQL
> injections that do not involve a ";" character.
>
> Can anyone familiar with the issue check that this is indeed a proper
> fix?
The code still looks vulnerable (to me).
The proper fix is a Parameterized Query. But you can't bind column
names, tables names or similar in a Parameterized Query. With lots of
hand-waiving, you can only bind variables found in a WHERE clause. So
Parameterized Query are not available in this case.
The next choice is a whitelist of names for the partition. That would
mostly fix the injection issue, but leave some residual risk since the
attacker still controls the partition name. But the attacker can only
select a whitelisted name.
And I could be completely sideways since I don't use Apache Airflow.
Jeff
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
