CVE-2021-44521 — Remote code execution for scripted UDFs

Description

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Cassandra	3.0.0 – < unspecified, unspecified – < 3.0.26, 3.1 – < unspecified, unspecified – < 3.11.12, 4.0.0 – < unspecified, unspecified – < 4.0.2	unspecified

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	druid	35.0.1-r1	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

WoodenKlaas/CVE-2021-44521 ★ 10 · Feb 24, 2022

Automated PoC of CVE-2021-44521
Yeyvo/poc-CVE-2021-44521 ★ 1 · Dec 3, 2022

full PoC of CVE-2021-44521

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Apache Cassandra Load UDF RCE network/cves/2021/CVE-2021-44521.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.cassandra:cassandra-all	< 3.0.26	3.0.26	GHSA-8ffc-79xg-29w8
Maven	org.apache.cassandra:cassandra-all	>= 3.11.0, < 3.11.12	3.11.12	GHSA-8ffc-79xg-29w8
Maven	org.apache.cassandra:cassandra-all	>= 4.0.0, < 4.0.2	4.0.2	GHSA-8ffc-79xg-29w8

Remote code execution for scripted UDFs