Apache Airflow Common SQL Provider SQL Injection Vulnerability Leading to Remote Code Execution

A SQL injection vulnerability allowing for remote code execution has been identified in Apache Airflow Common SQL Provider versions prior to 1.24.1. This issue arises from improper handling of special elements in SQL commands. When the partition clause is used in the SQLTableCheckOperator, authenticated users can inject arbitrary SQL commands. This exploitation occurs during the triggering of Directed Acyclic Graphs (DAGs), where the injected commands can be executed with escalated privileges.

Impact

Exploitation of this vulnerability allows authenticated users to inject and execute arbitrary SQL commands, potentially leading to unauthorized access or modification of data, and in this case, remote code execution.

Reproduction

To reproduce this vulnerability, an authenticated user can use the partition clause in the SQLTableCheckOperator. When the DAG is triggered, the user can inject SQL commands that will be executed with elevated privileges.

Remediation

Users are advised to upgrade to Apache Airflow Common SQL Provider version 1.24.1 or later, which addresses this vulnerability.