Description
Apache Airflow存在命令注入漏洞，此漏洞是缺乏校验导致的。
Apache Airflow CVE-2022-24288 命令注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://cloud.tencent.com/developer/article/2134972
https://nvd.nist.gov/vuln/detail/cve-2022-24288
https://seclists.org/oss-sec/2022/q1/160
https://www.dptech.com/index.php?m=content&c=index&a=file_down&fileurl=/uploadfile/2022/0308/20220308055606493.pdf
https://www.sentinelone.com/vulnerability-database/cve-2022-24288/
https://github.com/advisories/GHSA-v3c9-j6h9-66v4
https://zhuanlan.zhihu.com/p/569819137
https://access.redhat.com/security/cve/CVE-2022-24288
https://vulners.com/nuclei/NUCLEI:CVE-2022-24288
https://advisories.gitlab.com/pypi/apache-airflow/CVE-2022-24288/
https://blog.csdn.net/weixin_43080961/category_11819416.html
https://www.sonicwall.com/blog/apache-airflow-dag-injection-vulnerability
https://www.miggo.io/vulnerability-database/cve/CVE-2022-24288
https://www.vicarius.io/vsociety/posts/rce-via-example-dag-in-apache-airflow-cve-2022-40127