IMPORTANT:AttackDefense Labs is included with a Pentester Academy subscription! Upgrade Now to access over 1800+ Labs.

Already a Pentester Academy student? Your access will continue uninterrupted. Please use the same Google account to login here.

Not a Pentester Academy student? Try our Free Communitiy Labs

Apache Airflow 'Example DAG' Remote Code Execution

cve-2020 | Level: Easy  | Total Lab Runs: 0 | Premium Lab

Lab Scoreboard

What is Apache Airflow?

Airflow is a platform to programmatically author, schedule and monitor workflows.

Use Airflow to author workflows as Directed Acyclic Graphs (DAGs) of tasks. The Airflow scheduler executes your tasks on an array of workers while following the specified dependencies. Rich command line utilities make performing complex surgeries on DAGs a snap. The rich user interface makes it easy to visualize pipelines running in production, monitor progress, and troubleshoot issues when needed.


What is Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution vulnerability?

It refers to an exploit facilitating a blind unauthenticated remote code execution in Apache Airflow. The related exploit makes use of two CVEs in Apache Airflow: CVE-2020-11978 and CVE-2020-13927.

CVE-2020-13927 Description

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at Note this change fixes it for new installs but existing users need to change their config to default [api]auth_backend = airflow.api.auth.backend.deny_all as mentioned in the Updating Guide:

The base score assigned to this CVE was 9.8 (Critical)!

CVE-2020-11978 Description

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config, you are not vulnerable.

The base score assigned to this CVE was 8.8 (High)!

Lab Environment

In this lab environment, the user is going to get access to a Kali GUI instance. An Apache Airflow instance vulnerable to an unauthenticated blind remote code execution vulnerability, identified by CVE-2020-11978 and CVE-2020-13927, is running on the target server. It can be accessed using the tools installed on Kali at http://demo.ine.local:8080.

Objective: Leverage the vulnerable Apache Airflow instance to run your tasks as an unauthenticated user and gain code execution on the target server. Also, retrieve the flag from the target server!


  • This lab is dedicated to you! No other users are on this network :) 

  • Once you start the lab, you will have access to a root terminal of a Kali instance

  • Your Kali has an interface with IP address 192.X.Y.2. Run "ip addr" to know the values of X and Y.

  • The target phpMyAdmin instance should be accessible on http://demo.ine.local:8080.

  • Do not attack the gateway located at IP address 192.X.Y.1

1. Flag present on the target server

The following activities are strictly prohibited on this website unless otherwise explicitly stated as allowed in the mission statement:

  • Using automated scanners
  • Using brute force attacks
  • Denial of Service attacks
  • Attacking other student machines in challenges where you might achieve a shell on the vulnerable system
  • Attacking the lab infrastructure

Users violating the above will be either temporarily or permanently banned from the website. 

If you are unsure about an activity, then please contact support to confirm that it is allowed on our website.

Technical Support for this Lab:

There is a reason we provide unlimited lab time: you can take as much time as you need to solve a lab. However, we realize that sometimes hints might be necessary to keep you motivated!

We currently provide technical support limited to:

  • Giving hints for a lab exercise
  • In rare circumstances, if you have totally given up (NO!!!) then tell you how to solve it. This will be limited to sharing the solution video or lab report
  • A lab exercise fails to load or has errors in it

If you need technical support, please email  clearly mention the name and link of the lab exercise and other essential details. The more descriptive you are, the faster we can help you. We will get back to you within 24 hours or less. 

For adminitrative queries, billing, enterprise accounts etc. please email