# CVE-2022-38362: Apache Airflow Docker Provider <3.0 RCE vulnerability in example dag

Airflow Docker provider's example DAG passes user-supplied source_location into a BashOperator, letting an authenticated user inject OS commands and get RCE on the worker host.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by (vendor credit): Kai Zhao of 3H Secruity Team
- Found by: x_h1
- Disclosed: 2022-09-23
- CVE: CVE-2022-38362
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1671140
- Library page: https://bugbountylibrary.com/r/h1%3A1671140
- Tags: area:cloud domain:infra impact:rce kind:bounty platform:hackerone sev:high tech:python technique:source-review vuln:command-injection vuln:rce

**Target:** Airflow example DAG (example_docker_copy_data.py) / BashOperator
**Root cause:** The example DAG renders the externally controllable `source_location` param via Jinja2 into a bash_command executed by BashOperator, without sanitization, so shell metacharacters break out of the find command.
**Steps:**
1. Open DAGs menu and trigger `docker_sample_copy_data` via 'Trigger DAG w/ config' at `/trigger?dag_id=docker_sample_copy_data`.
2. Supply payload config `{"source_location":";touch /tmp/thisistest;"}`.
3. Trigger the task; the rendered command becomes `find ;touch /tmp/thisistest; -type f -printf "%f\n" | head -1`, executing the injected command.
4. Confirm execution via task log and server filesystem.
**How found:** Source review of example_docker_copy_data.py revealed a bash command execution function where the `{{params.source_location}}` template parameter is externally controllable and rendered through Jinja2; tracing into BashOperator confirmed bash_command is executed as a bash script.
**Exploitation:** An authenticated Airflow user triggers the example DAG with a crafted config; the `source_location` value is templated into the BashOperator command, and `;`-separated commands execute arbitrary OS commands on the Airflow worker host.
**Insight:** Example/sample DAGs shipped with orchestration tools often template user-controllable params into shell operators; audit example_dags for params rendered into BashOperator commands, since they are reachable by any authenticated user.

## Proof of concept (copied exactly from the original report)

**Injection payload via DAG config source_location**

````
PAYLOAD：```{"source_location":";touch /tmp/thisistest;"}```, Then click trigger to execute the task.
````

**Resulting injected find command**

```
locate_file_cmd = “”” sleep 10
find ;touch /tmp/thisistest; -type f -printf “%f\n” | head -1
“””
```