leanworld7-netizen commented on issue #70798: URL: https://github.com/apache/airflow/issues/70798#issuecomment-5145567801
Thank you for the detailed technical analysis @rjgoyln. I appreciate you taking the time to reproduce the paths. You are correct that in (override.py L418-L436), two of the three error branches return a response that would not directly bypass verification. However, the third path (L430-L434) is the concern: when but the response is still parsed via , if the Authentik server returns a non-200 response with a JSON body containing and other fields, those fields are used without verification that the token was actually valid. Specifically, the concern is: 1. Attacker controls or compromises the Authentik server (or MITM in non-TLS deployment) 2. Authentik returns HTTP 500 with JSON body containing crafted , , ubuntu adm dialout cdrom floppy sudo audio dip video plugdev netdev lxd fields 3. The error branch at L430 parses this as valid token info 4. Airflow creates a session with attacker-controlled identity I acknowledge the public disclosure concern @potiuk raised. I apologize for that - I should have used private security reporting channels. I will not add further technical details publicly. If there is a private channel available, I would be happy to provide a full PoC there. Closing this issue as it should not have been opened publicly. My apologies for the oversight. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
