CVE-2021-44521
published 2022-02-11CVE-2021-44521: When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true…
PriorityP272critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EXPLOIT
EPSS
54.73%
98.9th percentile
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | cassandra | >= 3.0.0 < 3.0.26 | 3.0.26 |
| apache | cassandra | >= 3.11.0 < 3.11.12 | 3.11.12 |
| apache | cassandra | >= 4.0.0 < 4.0.2 | 4.0.2 |
| apache_software_foundation | apache_cassandra | >= 3.0.0 < unspecified | unspecified |
| apache_software_foundation | apache_cassandra | >= 3.1 < unspecified | unspecified |
| apache_software_foundation | apache_cassandra | >= 4.0.0 < unspecified | unspecified |
| apache_software_foundation | apache_cassandra | >= unspecified < 3.0.26 | 3.0.26 |
| apache_software_foundation | apache_cassandra | >= unspecified < 3.11.12 | 3.11.12 |
| apache_software_foundation | apache_cassandra | >= unspecified < 4.0.2 | 4.0.2 |
Detection & IOCsextracted from sources · hover to see the quote
port9042
commandcreate or replace FUNCTION test.exec( cmd text )
RETURNS NULL ON NULL INPUT
RETURNS text
LANGUAGE javascript
AS $$
var System = Java.type("java.lang.System");System.setSecurityManager(null);
commandinsert into test.rce(cmd) values('echo 123123');
commandselect test.exec(cmd) from test.rce;
- →Detect exploit attempts by matching the CQL hex handshake sequence 050000000500000000 (OPTIONS frame) followed by a STARTUP frame on TCP port 9042, then a subsequent QUERY frame containing the UDF CREATE payload.
- →Nuclei template match condition: a response containing the string '123123' on port 9042 after sending the exploit payload confirms successful RCE via the UDF.
- ·Vulnerability is only exploitable when ALL THREE of the following non-default settings are simultaneously enabled in cassandra.yaml: enable_user_defined_functions: true, enable_scripted_user_defined_functions: true, AND enable_user_defined_functions_threads: false. The third setting (threads disabled) is the critical prerequisite that removes the sandbox. ↗
- ·Exploitation additionally requires the attacker to hold sufficient Cassandra permissions to CREATE user-defined functions in the cluster; unauthenticated or low-privilege users cannot trigger this. ↗
- ·This dangerous configuration is explicitly documented as unsafe by Apache Cassandra and remains unsafe even after patching; the fix adds additional restrictions but does not make the configuration safe. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv2.08.5HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
vendor_redhat9.1CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Cassandra vulnerable to Code Injection due to unsafe configuration
osv·2022-02-12
CVE-2021-44521 [CRITICAL] Apache Cassandra vulnerable to Code Injection due to unsafe configuration
Apache Cassandra vulnerable to Code Injection due to unsafe configuration
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
GHSA
Apache Cassandra vulnerable to Code Injection due to unsafe configuration
ghsa·2022-02-12
CVE-2021-44521 [CRITICAL] CWE-732 Apache Cassandra vulnerable to Code Injection due to unsafe configuration
Apache Cassandra vulnerable to Code Injection due to unsafe configuration
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Red Hat
cassandra: RCE for scripted UDFs
vendor_redhat·2022-02-11·CVSS 9.1
CVE-2021-44521 [CRITICAL] CWE-94 cassandra: RCE for scripted UDFs
cassandra: RCE for scripted UDFs
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
A flaw was found in Cassandra that allows users with certain permissions to execute user-defined functions to create scripts and run remote code execution. This flaw allows an attacker to gain unwanted access and also execute actions against Cassandra.
Statement: W
No detection rules found.
Nuclei
Apache Cassandra Load UDF RCE
nuclei·CVSS 9.1
CVE-2021-44521 [CRITICAL] Apache Cassandra Load UDF RCE
Apache Cassandra Load UDF RCE
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Template:
id: CVE-2021-44521
info:
name: Apache Cassandra Load UDF RCE
author: Y4er
severity: critical
description: 'When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enabl
http://www.openwall.com/lists/oss-security/2022/02/11/4https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356https://security.netapp.com/advisory/ntap-20220225-0001/http://www.openwall.com/lists/oss-security/2022/02/11/4https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356https://security.netapp.com/advisory/ntap-20220225-0001/
2022-02-11
Published