Apache Cassandra database affected by easily exploitable Remote code execution

Threat Level – Amber | Vulnerability Report

THREAT LEVEL: Amber.

For a detailed advisory, download the pdf file here

Apache Cassandra is a database software being used by many companies such as Uber, Facebook, Netflix, Twitter, Instagram, Spotify, Instacart, Reddit, and Accenture. A remote code execution flaw (CVE-2021-44521) is reported which is easily exploitable and has the potential to wreak havoc on systems.

This vulnerability affects the Apache Cassandra instances that have the following non-default configuration settings:

enable_user_defined_functions: true

enable_scripted_user_defined_functions: true

enable_user_defined_functions_threads: false

An attacker with sufficient permissions to construct user defined functions in the cluster might use these setups to execute arbitrary code on the host system.

This vulnerability could be easily mitigated by either

setting ‘enable_user_defined_functions_threads: true’, or

upgrading versions 3.0.x to 3.0.26, 3.11.x to 3.11.12 or 4.0.x to 4.0.2

Potential MITRE ATT&CK TTPs are:

TA0001: Initial Access

TA0002: Execution

T1190: Exploit-public facing application

T1059: Command and Scripting Interpreter

T1059.007: Command and Scripting Interpreter: JavaScript