search

google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
Apache License 2.0
870 stars 176 forks source link

AI PRP: Apache airflow default credential tester #521

Open joernNNN opened 1 month ago

joernNNN commented 1 month ago

HI, during the research of my other AI PRP, I found out that the airflow docker compose setup has a default credential airflow:airflow. I would like to develop a plugin for Apache Airflow instances that functions as a weak credential tester. the docker compose reference: https://airflow.apache.org/docs/apache-airflow/stable/howto/docker-compose/index.html#setting-the-right-airflow-user

image

the approach of testing can be checking for successful access to the root admin page which has a list of DAGs.

tooryx commented 1 month ago

Hi @joernNNN,

Could you work on this to start? We are still discussing the open configuration one internally.

~tooryx

joernNNN commented 1 month ago

@tooryx OK, I'll work on this submission first.