CyberRota Analysis
AI-GeneratedApache Airflow's Google provider operators, specifically `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator`, are vulnerable due to insufficient path normalization, allowing users with write access to the source GCS bucket to manipulate object names and potentially overwrite arbitrary files on the SFTP server or worker host. This vulnerability poses a significant risk to deployments that ingest data from buckets writable by less-trusted principals, such as partner uploads or public-data buckets. Organizations using these operators should prioritize upgrading to version 22.2.1 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contains `..` segments and cause the DAG run to write the downloaded blob outside the configured destination (the SFTP `destination_path` for `GCSToSFTPOperator`; the worker-local temp directory for `GCSTimeSpanFileTransformOperator`), enabling overwrite of arbitrary files on the SFTP server or the worker host. Affects deployments that ingest from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` 22.2.1 or later.
Related CVEs
Other vulnerabilities affecting the same vendor(s)