CVE-2021-44521: Remote code execution for scripted UDFs
First published: Fri Feb 11 2022(Updated: )
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Cassandra | >=3.0.0<3.0.26 | |
| Apache Cassandra | >=3.11.0<3.11.12 | |
| Apache Cassandra | >=4.0.0<4.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-44521?
CVE-2021-44521 is a vulnerability in Apache Cassandra that allows an attacker to execute arbitrary code on the host.
How severe is CVE-2021-44521?
CVE-2021-44521 has a severity rating of 9.1 (Critical).
Which versions of Apache Cassandra are affected by CVE-2021-44521?
Versions 3.0.0 to 3.0.26, 3.11.0 to 3.11.12, and 4.0.0 to 4.0.2 of Apache Cassandra are affected by CVE-2021-44521.
How can an attacker exploit CVE-2021-44521?
An attacker can exploit CVE-2021-44521 by taking advantage of the enable_user_defined_functions and enable_scripted_user_defined_functions configurations in Apache Cassandra.
Are there any references for CVE-2021-44521?
Yes, you can find more information about CVE-2021-44521 at the following references: [Reference 1](http://www.openwall.com/lists/oss-security/2022/02/11/4), [Reference 2](https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/), [Reference 3](https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/title
- agent/author
- agent/weakness
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/apache
- canonical/apache cassandra
- version/apache cassandra/3.0.0
- version/apache cassandra/3.11.0
- version/apache cassandra/4.0.0