Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-34395

CVE-2023-34395: Apache Airflow ODBC Provider Argument Injection vulnerability

7.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-34395
GHSA ID
GHSA-9766-v29c-4vm7
EPSS Score
0.38573%
CWE
CWE-88
Published
6/27/2023
Updated
11/10/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
apache-airflow-providers-odbcpip< 4.0.04.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from how OdbcHook handled driver parameters before version 4.0.0. The driver property (in odbc.py) previously extracted driver values from connection extras without validation, as shown in the pre-patch code where it checked self.connection_extra_lower.get('driver'). This allowed malicious actors to specify dangerous driver paths through UI-editable connection configurations. The patch added 'allow_driver_extra' checks and warnings, confirming the pre-patch implementation was unsafe. The tests (test_odbc.py) demonstrate that driver extra was previously accepted by default, and the changelog explicitly states constructor enforcement as the mitigation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Improp*r N*utr*liz*tion o* *r*um*nt **limit*rs in * *omm*n* ('*r*um*nt Inj**tion') vuln*r**ility in *p**** So*tw*r* *oun**tion *p**** *ir*low O*** Provi**r. In O****ook, * privil*** *s**l*tion vuln*r**ility *xists in * syst*m *u* to *ontroll**l* O***

Reasoning

T** vuln*r**ility st*ms *rom *ow O****ook **n*l** *riv*r p*r*m*t*rs ***or* v*rsion *.*.*. T** *riv*r prop*rty (in o***.py) pr*viously *xtr**t** *riv*r v*lu*s *rom *onn**tion *xtr*s wit*out v*li**tion, *s s*own in t** pr*-p*t** *o** w**r* it ****k** s