CVE-2025-30473

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-30473
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to escalate privileges to execute those arbitrary commands which they normally would not have. This issue affects Apache Airflow Common SQL Provider: before 1.24.1. Users are recommended to upgrade to version 1.24.1, which fixes the issue.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/apache/airflow/pull/48098 Issue Tracking Patch
https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2 Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/04/04/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2025/04/06/1 Mailing List
http://www.openwall.com/lists/oss-security/2025/04/06/2 Mailing List
http://www.openwall.com/lists/oss-security/2025/04/06/3 Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow_common_sql_provider:*:*:*:*:*:*:*:*
History

11 Apr 2025, 12:59

Type Values Removed Values Added
References () https://github.com/apache/airflow/pull/48098 - () https://github.com/apache/airflow/pull/48098 - Issue Tracking, Patch
References () https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2 - () https://lists.apache.org/thread/53klkv790cylqcop0350w7nfq1y6h0t2 - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2025/04/04/2 - () http://www.openwall.com/lists/oss-security/2025/04/04/2 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2025/04/06/1 - () http://www.openwall.com/lists/oss-security/2025/04/06/1 - Mailing List
References () http://www.openwall.com/lists/oss-security/2025/04/06/2 - () http://www.openwall.com/lists/oss-security/2025/04/06/2 - Mailing List
References () http://www.openwall.com/lists/oss-security/2025/04/06/3 - () http://www.openwall.com/lists/oss-security/2025/04/06/3 - Mailing List
First Time Apache
Apache airflow Common Sql Provider
CPE cpe:2.3:a:apache:airflow_common_sql_provider:*:*:*:*:*:*:*:*

07 Apr 2025, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

07 Apr 2025, 14:17

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en una vulnerabilidad de comando SQL ('Inyección SQL') en el proveedor SQL común de Apache Airflow. Al usar la cláusula de partición en SQLTableCheckOperator como parámetro (un patrón recomendado), el usuario autenticado de la interfaz de usuario podía inyectar un comando SQL arbitrario al activar el DAG, exponiendo la cláusula de partición al usuario. Esto permitía al usuario que activaba el DAG escalar privilegios para ejecutar dichos comandos arbitrarios, algo que normalmente no tendría. Este problema afecta al proveedor SQL común de Apache Airflow: versiones anteriores a la 1.24.1. Se recomienda actualizar a la versión 1.24.1, que soluciona el problema.

07 Apr 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-07 09:15

Updated : 2025-04-11 12:59

NVD link : CVE-2025-30473

Mitre link : CVE-2025-30473

CVE.ORG link : CVE-2025-30473

JSON object : View

Products Affected

apache

  • airflow_common_sql_provider
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')