PRP: Request CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass

[frkngksl]

PRP: Request CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass

[tooryx]

Hi @frkngksl,

Thanks for your request! This vulnerability is in scope for the reward program. Please submit our participation form and you can start working on the development.

Please keep in mind that the Tsunami Scanner Team will only be able to work at one issue at a time for each participant so please hold on the implementation work for any other requests you might have.

Thanks!

[frkngksl]

Hi @tooryx, I submitted the detector and docker files. Thanks in advance.

[frkngksl]

Hi @maoning, Is this issue can be counted as an AI PRP now?

[maoning]

@frkngksl I just noticed that your request here overlaps with an existing AI plugin request #428. It's my fault of not noticing the overlap. I hope by using the new ai-bounty-prp tag, it would prevent similar issue from happening.

As the #428 has RCE verification, I will merge in that one instead. However I will make sure your other PRs are timely reviewed.

[frkngksl]

Hi @maoning, that issue was accepted last month and the CVE was specific for the lack of authentication in the experimental API. It is true that it can be combined with another CVE for RCE (as specified in the other issue RCE is valid for very specific DAG) but this API provides other functionalities. In my opinion, this should be considered as seperate, otherwise it is a little bit unfair (with all my respect) because I developed a plugin after getting an approval from you.

[maoning]

@frkngksl I would definitely want to prevent this from happening in the future and will discuss this with the entire review panel. You effort here is recognized.

In general, we prefer RCE based vuln verification for Tsunami plugins, while it's not always possible, we lean more towards finding fewer critical bugs than producing too many findings.