CVE-2021-44521: Remote code execution for scripted UDFs
When running Apache Cassandra with the following configuration: enableuserdefinedfunctions: true enablescripteduserdefinedfunctions: true enableuserdefinedfunctionsthreads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-44521?
CVE-2021-44521 is a vulnerability in Apache Cassandra that allows an attacker to execute arbitrary code on the host.
How severe is CVE-2021-44521?
CVE-2021-44521 has a severity rating of 9.1 (Critical).
Which versions of Apache Cassandra are affected by CVE-2021-44521?
Versions 3.0.0 to 3.0.26, 3.11.0 to 3.11.12, and 4.0.0 to 4.0.2 of Apache Cassandra are affected by CVE-2021-44521.
How can an attacker exploit CVE-2021-44521?
An attacker can exploit CVE-2021-44521 by taking advantage of the enable_user_defined_functions and enable_scripted_user_defined_functions configurations in Apache Cassandra.
Are there any references for CVE-2021-44521?
Yes, you can find more information about CVE-2021-44521 at the following references: [Reference 1](http://www.openwall.com/lists/oss-security/2022/02/11/4), [Reference 2](https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/), [Reference 3](https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356).