Remote code execution for scripted UDFs

Vulnerability

When running Apache Cassandra with the configuration enable_user_defined_functions: true, enable_scripted_user_defined_functions: true, and enable_user_defined_functions_threads: false, an attacker can execute arbitrary code on the host [1][3][4]. This configuration is documented as unsafe. Affected versions include 3.0.x before 3.0.26, 3.11.x before 3.11.12, and 4.0.x before 4.0.2 [3][4].

Exploitation

An attacker must have sufficient permissions to create user defined functions (UDFs) in the cluster [1][3]. By creating a malicious scripted UDF, the attacker can trigger arbitrary code execution when the UDF is invoked [3]. No additional authentication or user interaction beyond UDF creation is required.

Impact

Successful exploitation allows arbitrary code execution on the host, leading to full compromise of the Cassandra node. The attacker can read, modify, or delete data, and potentially move laterally within the network.

Mitigation

Set enable_user_defined_functions_threads: true (the default) or upgrade to fixed versions: 3.0.26 for 3.0 users, 3.11.12 for 3.11 users, and 4.0.2 for 4.0 users [3][4]. No other workarounds exist; the configuration is intentionally unsafe.