CVE-2025-30473

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have. This issue affects Apache Airflow Common SQL Provider: before 1.24.1. Users are recommended to upgrade to version 1.24.1, which fixes the issue.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/airflow/pull/48098	Issue Tracking Patch
https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/04/04/2	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/04/06/1	Mailing List
http://www.openwall.com/lists/oss-security/2025/04/06/2	Mailing List
http://www.openwall.com/lists/oss-security/2025/04/06/3	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow_common_sql_provider:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-04-07 09:15

Updated : 2025-04-11 12:59

NVD link : CVE-2025-30473

Mitre link : CVE-2025-30473

CVE.ORG link : CVE-2025-30473

JSON object : View

Products Affected

apache

airflow_common_sql_provider

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-30473", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-04-07T09:15:16.667", "references": [{"url": "https://github.com/apache/airflow/pull/48098", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/04/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/06/1", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/06/2", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2025/04/06/3", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider.\n\nWhen using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user.\nThis allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have.\n\n\nThis issue affects Apache Airflow Common SQL Provider: before 1.24.1.\n\nUsers are recommended to upgrade to version 1.24.1, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en una vulnerabilidad de comando SQL ('Inyecci\u00f3n SQL') en el proveedor SQL com\u00fan de Apache Airflow. Al usar la cl\u00e1usula de partici\u00f3n en SQLTableCheckOperator como par\u00e1metro (un patr\u00f3n recomendado), el usuario autenticado de la interfaz de usuario pod\u00eda inyectar un comando SQL arbitrario al activar el DAG, exponiendo la cl\u00e1usula de partici\u00f3n al usuario. Esto permit\u00eda al usuario que activaba el DAG escalar privilegios para ejecutar dichos comandos arbitrarios, algo que normalmente no tendr\u00eda. Este problema afecta al proveedor SQL com\u00fan de Apache Airflow: versiones anteriores a la 1.24.1. Se recomienda actualizar a la versi\u00f3n 1.24.1, que soluciona el problema."}], "lastModified": "2025-04-11T12:59:03.450", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow_common_sql_provider:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1C538E3-3A53-4DE7-9ABD-F7293C046752", "versionEndExcluding": "1.24.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}