Apache Cassandra anfällig für (Code Injection) aufgrund unsicherer Konfiguration

The impact of CVE-2021-44521 is severe. An attacker who can create UDFs within a Cassandra cluster can leverage this vulnerability to execute arbitrary code with the privileges of the Cassandra process. This could involve gaining persistent access to the system, exfiltrating sensitive data stored within Cassandra, or even using the compromised server as a launchpad for further attacks within the network. The ability to execute arbitrary code effectively grants the attacker complete control over the affected Cassandra node. This vulnerability shares similarities with other UDF-based RCE vulnerabilities, highlighting the importance of carefully reviewing and restricting UDF usage in production environments. The blast radius extends to any data stored within the compromised Cassandra cluster and potentially to other systems accessible from the compromised node.

Organizations running Apache Cassandra in production environments, particularly those utilizing user-defined functions, are at risk. Environments with less stringent access controls, where users have broad permissions to create objects within the Cassandra cluster, are especially vulnerable. Shared hosting environments where multiple tenants share a Cassandra instance are also at increased risk.

• linux / server:

journalctl -u cassandra | grep -i "user defined function"

• java: Inspect cassandra.yaml for the presence of enableuserdefinedfunctions: true, enablescripteduserdefinedfunctions: true, and enableuserdefinedfunctions_threads: false. • generic web: Check Cassandra configuration files for the vulnerable settings. Review access logs for unusual UDF creation requests.

1. 2021-08-17Discovery

   discovery

2. 2022-02-12Disclosure

   disclosure

3. 2022-02-12Patch

   patch

1. Reserviert2021-12-02
2. Veröffentlicht2022-02-12
3. Geändert2023-12-06
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2021-44521 is to upgrade to Apache Cassandra version 3.0.26 or later. This version includes a fix that addresses the vulnerability. If upgrading immediately is not feasible, consider disabling user-defined functions entirely by setting enableuserdefined_functions=false in the cassandra.yaml configuration file. Alternatively, restrict the permissions of users who can create UDFs to minimize the potential attack surface. As a temporary workaround, consider implementing a Web Application Firewall (WAF) or proxy to filter out malicious UDF requests, although this is not a substitute for patching. After upgrading, confirm the fix by attempting to create and execute a UDF with potentially malicious code; it should be rejected.