Poorly Configured Apache Airflow Instances Leak Credentials for Popular Services

guest · Oct 4, 2021

Poorly Configured Apache Airflow Instances Leak Credentials for Popular Services
October 4, 2021
https://thehackernews.com/2021/10/poorly-configured-apache-airflow.html

Cybersecurity researchers on Monday discovered misconfigurations across older versions of Apache Airflow instances belonging to a number of high-profile companies across various sectors, resulting in the exposure of sensitive credentials for popular platforms and services such as Amazon Web Services (AWS), Binance, Google Cloud Platform (GCP), PayPal, Slack, and Stripe.

"These unsecured instances expose sensitive information of companies across the media, finance, manufacturing, information technology (IT), biotech, e-commerce, health, energy, cybersecurity, and transportation industries," Intezer said in a report shared with The Hacker News.
Click to expand...

Chief among the concerns associated with misconfigured Airflow instances is the exposure of credentials that could be abused by threat actors to gain access to accounts and databases, giving them the ability to spread laterally or result in data leakage, not to mention lead to violation of data protection laws and give an insight into an organization's tools and packages, which could later be exploited to stage supply-chain attacks.

"If a large number of passwords are visible, a threat actor can also use this data to detect patterns and common words to infer other passwords," Intezer researchers said. "These can be leveraged in dictionary or brute-force-style attacks against other platforms."
Apache Airflow, for its part, has remediated a lot of security issues with version 2.0.0 that was released in December 2020, making it critical that users of the software update to the latest version and adopt secure coding practices to prevent passwords from being exposed.
Click to expand...

Intezer: Misconfigured Airflows Leak Thousands of Credentials from Popular Services

Workflow management platforms are an indispensable tool for automating business and IT tasks. These platforms make it easier to create, schedule and monitor workflows. They are typically hosted on the cloud to provide increased accessibility and scalability. On the flip side, misconfigured instances that allow internet-wide access make these platforms ideal candidates for exploitation by attackers.
Click to expand...

Key Findings

A number of misconfigured Airflow instances have exposed the credentials of popular services including cloud hosting providers, payment processing, and social media platforms.

Exposing secrets such as user credentials can cause data leakage or provide attackers with the ability to spread further in the system.

Customer data exposed as a result of a data leak can lead to violation of data protection laws and the possibility of legal action.

There is also the possibility that malicious code execution and malware can be launched on the exposed production environments and even on Apache Airflow itself.

We have notified the identified entities to fix their misconfigured Airflow instances as part of the responsible disclosure policy.

Click to expand...

Log in or Sign up

Poorly Configured Apache Airflow Instances Leak Credentials for Popular Services

guest Guest

Log in or Sign up

Poorly Configured Apache Airflow Instances Leak Credentials for Popular Services

guest Guest

Useful Searches