# CVE-2024-45498: Apache Airflow Command injection in read_dataset_event_from_classic DAG

Airflow's read_dataset_event_from_classic DAG interpolates dataset extra fields into a bash command, letting a low-privileged user inject OS commands via dataset events.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by (vendor credit): Nhien Pham (aka nhienit) at Galaxy One
- Found by: nhienit2010
- Disclosed: 2024-12-07
- CVE: CVE-2024-45498
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2705661
- Library page: https://bugbountylibrary.com/r/h1%3A2705661
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:low tech:python technique:source-review vuln:command-injection vuln:rce

**Target:** Airflow datasets events API and example DAG
**Root cause:** The example DAG read_dataset_event_from_classic builds a bash command using dataset event extra data without sanitization, so attacker-controlled strings are evaluated by the shell.
**Steps:**
1. Login as a user with create-Dataset and DAG-trigger permissions
2. POST /api/v1/datasets/events with `{"dataset_uri":"s3://output/1.txt","extra":{"hi":" '$(gnome-calculator)' "}}`
3. Trigger the read_dataset_event_from_classic DAG
4. Observe command execution in the task log
**How found:** Researcher inspected the example DAG's use of Dataset extra fields and noticed they flow into a bash command, then tested injection via the datasets events API.
**Exploitation:** A user with dataset-create and DAG-trigger rights submits a dataset event whose extra field contains a shell substitution payload; when the DAG runs, the payload is interpolated into a bash command and executed on the worker.
**Insight:** Example/sample DAGs shipped in a product can be a real attack surface: dataset event 'extra' metadata is user-writable and often templated into shell or Jinja contexts.