{"id":14139,"date":"2022-02-17T02:07:12","date_gmt":"2022-02-17T02:07:12","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/17\/apache-cassandra-vulnerability-has-the-potential-to-wreak-havoc\/"},"modified":"2022-02-17T02:07:12","modified_gmt":"2022-02-17T02:07:12","slug":"apache-cassandra-vulnerability-has-the-potential-to-wreak-havoc","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/17\/apache-cassandra-vulnerability-has-the-potential-to-wreak-havoc\/","title":{"rendered":"Apache Cassandra vulnerability has the potential to ‘wreak havoc’"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

A new remote code execution vulnerability in Apache Cassandra has the potential to \u201cwreak havoc\u201d on systems used by large companies.<\/p>\n

Cassandra is a free, open-source, distributed NoSQL database management system that handles large amounts of data across commodity servers.\u00a0Originally created by Facebook Inc., now Meta Platforms Inc., Cassandra provides extremely high availability with no single point of failure, making it useful for applications that track and monitor user activity, social media analytics and messaging applications.<\/p>\n

Cassandra is used by enterprises such as Netflix Inc., Twitter Inc., Airship Group Inc., Constant Contact Inc., Reddit Inc., Cisco Systems Inc., OpenX, Digg Inc. and CloudKick. It\u2019s also a popular service in DevOps and cloud-native development.<\/p>\n

Discovered by<\/a> security researchers at JFrog Inc. and revealed Tuesday, the vulnerability, officially named\u00a0CVE-2021-44521<\/a>, has a Common Vulnerability Scoring System score of 8.4 out of 10, which is considered high. The vulnerability is related to a failure to sanitize user-defined function inputs properly.<\/p>\n

The issue is specifically with the Nashorn engine within Cassandra\u2019s Runtime Environment, a JavaScript engine that runs on top of the Java Virtual Machine. Nashorn is not guaranteed to be secure when accepting untrusted code, the researchers note.<\/p>\n

As a result, any service that allows such behavior must wrap the Nashorn execution in a sandbox. However, the researchers found that nondefault configuration options could allow an attacker to abuse the Nashorn engine and gain access to a targeted system.\u00a0While noting that the security vulnerability is easy to exploit, the researchers add that it only manifests in non-default configurations.<\/p>\n

Those running Apache Cassandra are urged to update their installations to the latest release, which addresses the vulnerability.<\/p>\n

\u201cCassandra is a broadly used database for companies of all sizes,\u201d Casey Bisson, head of product and developer relations at\u00a0code security solutions provider BluBracket Inc.<\/a>, told SiliconANGLE. \u201cIt\u2019s reported to be used as critical infrastructure supporting multiple top-tier internet giants, so a remote code execution vulnerability could have a broad impact with very serious consequences. Threat actors may be able to read or manipulate sensitive data in vulnerable configurations.\u201d<\/p>\n

John Bambenek, Principal Threat Hunter at information technology and security operations company Netenrich Inc.<\/a>, noted that though it\u2019s not as serious as Log4j, it does look like it\u2019s potentially widespread.<\/p>\n

\u201cEven though it requires nondefault user configuration settings, I suspect that the settings are common in many applications around the world,\u201d Bambenek explained. \u201cUnfortunately, there is no way to know exactly how many installations are vulnerable and this is likely the kind of vulnerability that will be missed by automated vulnerability scanners. Enterprises will have to go into the configuration files of every Cassandra instance to determine what their risk is.\u201d<\/p>\n

Image: Apache Cassandra<\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n