PT-2022-2317 · Apache · Apache Cassandra

Omer Kaspi · Published 2022-02-11 · Updated 2024-03-06 · CVE-2021-44521

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Cassandra versions prior to 3.0.26 Apache Cassandra versions prior to 3.11.12 Apache Cassandra versions prior to 4.0.2

Description The issue is related to the incorrect management of code generation in Apache Cassandra, which can allow an attacker to execute arbitrary code on the host. This can be achieved by exploiting a specific configuration scenario where user-defined functions (UDFs) are enabled, allowing the attacker to effectively utilize the Nashorn JavaScript engine to escape the sandbox and execute unreliable code. The configuration that makes Cassandra vulnerable includes the following parameters in cassandra.yaml: enable user defined functions: true, enable scripted user defined functions: true, and enable user defined functions threads: false. When the enable user defined functions threads parameter is set to false, all invoked UDF functions are executed in the Cassandra daemon, which has a security manager with some permissions, thus allowing the attacker to disable the security manager, escape the sandbox, and run arbitrary shell commands on the server.

Recommendations For Apache Cassandra versions prior to 3.0.26, update to version 3.0.26 or later. For Apache Cassandra versions prior to 3.11.12, update to version 3.11.12 or later. For Apache Cassandra versions prior to 4.0.2, update to version 4.0.2 or later. As a temporary workaround, consider disabling the enable user defined functions and enable scripted user defined functions configurations to minimize the risk of exploitation. Restrict access to the cassandra.yaml file to prevent modifications that could enable the vulnerable configuration.

Exploit

Fix

Code Injection

Incorrect Permission

Weakness Enumeration

CWE-94

CWE-732

Related Identifiers

BDU:2022-02507

BIT-CASSANDRA-2021-44521

CVE-2021-44521

GHSA-8FFC-79XG-29W8

Affected Products

Apache Cassandra

References · 25

• 🔥 https://github.com/QHpix/CVE-2021-44521 · Exploit
• 🔥 https://github.com/WoodenKlaas/CVE-2021-44521 · Exploit
• 🔥 https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution · Exploit
• https://osv.dev/vulnerability/CVE-2021-44521 · Vendor Advisory
• https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cassandra-2021-44521 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8ffc-79xg-29w8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02507 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-44521 · Security Note
• https://github.com/apache/cassandra · Note
• https://t.me/cvenotify/26968 · Telegram Post
• https://t.me/secharvester/12057 · Telegram Post
• https://t.me/true_secator/2636 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220225-0001 · Note
• https://issues.apache.org/jira/browse/CASSANDRA-17352 · Note