Apache Cassandra vulnerable a Inyección de Código debido a una configuración insegura

The impact of this vulnerability is severe. Successful exploitation allows an attacker to gain complete control over the Cassandra server, potentially leading to data breaches, system compromise, and denial of service. An attacker could exfiltrate sensitive data stored within the Cassandra database, modify data, or use the compromised server as a launchpad for further attacks within the network. The ability to execute arbitrary code means the attacker is not limited to specific actions; they can perform any operation the Cassandra process has permissions to do. This is particularly concerning in environments where Cassandra is used to store critical business data or manage sensitive user information. The documented unsafe configuration highlights the risk of misconfiguration leading to severe security consequences.

Organizations running Apache Cassandra in production environments, particularly those utilizing user-defined functions, are at risk. Environments with less stringent access controls, where users have broad permissions to create objects within the Cassandra cluster, are especially vulnerable. Shared hosting environments where multiple tenants share a Cassandra instance are also at increased risk.

• linux / server:

journalctl -u cassandra | grep -i "user defined function"

• java: Inspect cassandra.yaml for the presence of enableuserdefinedfunctions: true, enablescripteduserdefinedfunctions: true, and enableuserdefinedfunctions_threads: false. • generic web: Check Cassandra configuration files for the vulnerable settings. Review access logs for unusual UDF creation requests.

1. 2021-08-17Discovery

   discovery

2. 2022-02-12Disclosure

   disclosure

3. 2022-02-12Patch

   patch

1. Reservado2021-12-02
2. Publicada2022-02-12
3. Modificada2023-12-06
4. EPSS actualizado2026-04-02

The primary mitigation for CVE-2021-44521 is to upgrade to Apache Cassandra version 3.0.26 or later, which contains the fix. If an immediate upgrade is not feasible, disabling user-defined functions (UDFs) is a critical temporary workaround. Specifically, set enableuserdefinedfunctions=false in the cassandra.yaml configuration file. Additionally, disable scripted UDFs by setting enablescripteduserdefined_functions=false. Consider implementing a Web Application Firewall (WAF) or proxy to filter requests that attempt to create or execute UDFs. Monitor Cassandra logs for suspicious activity related to UDF creation or execution. After upgrading, verify the fix by attempting to create and execute a UDF with the previously vulnerable configuration; the operation should fail.