Apache Airflow Configuration Exposure

Description

Apache Airflow is used by organizations in sectors such as cybersecurity, ecommerce, energy, finance, health, information technology, manufacturing, media, and transportation. Misconfigured Apache Airflow instances that exposed sensitive information to anyone on the Internet. In most cases, insecure configuration is what led to the leak. The configuration file (airflow.cfg) is created when Airflow is first started. It contains Airflow’s configuration and it is able to be changed . The file contains secrets such as passwords and keys. But, if the expose_config option in the file is mistakenly set to ‘True’ the configuration becomes accessible to anyone via the web server,

Mitigation measures

Set the expose_config option to ‘False’

Written by

Rejah Rehim

Co-founder, Director

Rejah brings more than 12 years of industry experience in Information Technology. He is a fervent security enthusiast and serves as a Project Leader at OWASP Foundation, and Commander (Hon.) at Kerala Police. He has authored two books titled “Effective Python Penetration Testing” and “Python Penetration Testing Cookbook” and is the creator of 9 Mozilla add-ons.