search

google / security-testbeds

Apache License 2.0
21 stars 27 forks source link

CVE-2020-17526 Auth Bypass in Airflow lead into RCE #35

Closed am0o0 closed 7 months ago

am0o0 commented 7 months ago

As this is a RCE with OOB callback I don't think we need a setup for patched version! https://github.com/google/tsunami-security-scanner-plugins/issues/428

google-cla[bot] commented 7 months ago

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

maoning commented 7 months ago

@am0o0 could you also provide the setup config for the secure version of airflow?

am0o0 commented 7 months ago

OK, I'll provide that too, but I don't think it is needed because we must have an OOB callback as a confirmation.

am0o0 commented 7 months ago

@maoning I added the secure version setup.

maoning commented 7 months ago

@am0o0 Could you do a rebase on your PR, the code import step is having some issues.