CVE-2020-13946

Vulnerability

Overview

CVE-2020-13946 affects Apache Cassandra versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2. The vulnerability allows a local attacker without access to Cassandra process or configuration files to manipulate the RMI registry. By performing a man-in-the-middle attack, the attacker can capture user names and passwords used to access the JMX interface [1].

Exploitation

Details

The attack requires local access to the host running Apache Cassandra. The attacker does not need access to the Apache Cassandra process or its configuration files. The vulnerability is in the RMI registry, which is used for JMX connections. By exploiting this issue, the attacker can intercept authentication credentials transmitted between JMX clients and the JMX server [1].

Impact

With the captured credentials, the attacker can authenticate to the JMX interface and perform unauthorized operations. This can lead to significant compromise of the Cassandra installation, including potential data access, modification, or disruption of service. The issue is related to CVE-2019-2684, a JRE vulnerability that could allow this attack to be executed remotely [1].

Mitigation

Users should upgrade to Apache Cassandra 2.1.22, 2.2.18, 3.0.22, 3.11.8, or 4.0-beta2 or later. Restricting local access to the host and using secure JMX configurations (such as SSL/TLS) can also reduce risk [1].