Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra
This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1.
WORKAROUND
The vulnerability requires nodetool/JMX access to be exploitable, disable access for any non-trusted users.
MITIGATION
Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditlog configuration property allow_nodetool_archive_command as false.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: apache
Published: 2023-05-30T07:25:49.920Z
Updated: 2024-08-02T14:28:52.010Z
Reserved: 2023-04-13T07:56:36.918Z
Link: CVE-2023-30601
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2023-05-30T08:15:10.450
Modified: 2023-06-05T16:41:46.257
Link: CVE-2023-30601
Redhat
No data.