by Kastro
Paper/Archive/CVE-2021-44521

CVE-2021-44521

Apache Software Foundation Apache Cassandra — Remote code execution for scripted UDFs

EPSS 59%CVSS 9.1
critical.is priorityof 100
47
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 99.1.991 × 2019.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.

Affected

ProductAffectedFixed inSource
Apache Cassandra3.0.0 – < unspecifiedunspecifiedCNA
Apache Cassandraunspecified – < 3.0.263.0.26CNA
Apache Cassandra3.1 – < unspecifiedunspecifiedCNA
Apache Cassandraunspecified – < 3.11.123.11.12CNA
Apache Cassandra4.0.0 – < unspecifiedunspecifiedCNA
Apache Cassandraunspecified – < 4.0.24.0.2CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

reflists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356refopenwall.com/lists/oss-security/2022/02/11/4refjfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-executionrefsecurity.netapp.com/advisory/ntap-20220225-0001