{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cql/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2021-44521"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cassandra"],"_cs_severities":["high"],"_cs_tags":["vulnerability","execution","cassandra","cql","sandbox-escape"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eThis threat involves the abuse of Apache Cassandra's user-defined function (UDF) capability to execute arbitrary operating-system commands. By creating UDFs written in JavaScript, an attacker can leverage vulnerabilities such as CVE-2021-44521 to escape the Nashorn JavaScript sandbox. When Cassandra is configured with unsafe thread settings for scripted UDFs, this mechanism allows for full remote code execution on the database server. Defenders must monitor for unauthorized 'CREATE FUNCTION' operations within Cassandra Query Language (CQL) traffic. This technique is particularly dangerous because it grants the attacker code execution context with the privileges of the Cassandra database service, potentially leading to full system compromise, data exfiltration, or persistence within the cluster.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains access to the database or a client machine capable of sending CQL queries to the Cassandra cluster.\u003c/li\u003e\n\u003cli\u003eAttacker checks the Cassandra configuration for 'enable_scripted_user_defined_functions' and 'enable_user_defined_functions_threads' to determine exploitability.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a 'CREATE FUNCTION' CQL statement specifying the 'javascript' language.\u003c/li\u003e\n\u003cli\u003eThe malicious function body is crafted to include Java reflection or class loading calls designed to bypass the Nashorn sandbox, targeting CVE-2021-44521.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the crafted CQL statement against the target keyspace.\u003c/li\u003e\n\u003cli\u003eThe Cassandra engine parses the statement and initializes the malicious JavaScript function within the database service context.\u003c/li\u003e\n\u003cli\u003eThe attacker invokes the UDF, triggering the sandbox escape and executing the attacker's payload (e.g., shell commands) on the host OS.\u003c/li\u003e\n\u003cli\u003eFinal objective achieved: remote command execution, potentially leading to data exfiltration or internal network reconnaissance.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated or unauthorized users to achieve full remote code execution on the underlying database host. This impacts the confidentiality, integrity, and availability of the database, posing a high risk to any data stored within the Cassandra cluster. The ability to escape the sandbox allows an attacker to move from the database layer to the operating system layer, facilitating further lateral movement within the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Apache Cassandra installations to a version that addresses CVE-2021-44521.\u003c/li\u003e\n\u003cli\u003eDisable 'enable_scripted_user_defined_functions' in the 'cassandra.yaml' configuration file if UDFs are not required for business operations.\u003c/li\u003e\n\u003cli\u003eDeploy network traffic monitoring to detect cleartext CQL 'CREATE FUNCTION' commands containing 'language javascript'.\u003c/li\u003e\n\u003cli\u003eImplement stringent role-based access control (RBAC) to restrict the ability to create UDFs to only highly trusted and verified administrative accounts.\u003c/li\u003e\n\u003cli\u003eReview cluster audit logs for unexpected or unauthorized UDF creation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-31T19:10:38Z","date_published":"2026-07-31T19:10:38Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cassandra-javascript-udf/","summary":"Adversaries can exploit the creation of JavaScript-based user-defined functions in Apache Cassandra to escape the Nashorn sandbox and achieve remote code execution, particularly when vulnerable to CVE-2021-44521.","title":"Apache Cassandra JavaScript User-Defined Function Execution","url":"https://feed.craftedsignal.io/briefs/2026-07-cassandra-javascript-udf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cql","version":"https://jsonfeed.org/version/1.1"}