The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0
    through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote
    attackers to execute arbitrary Java code via an RMI request. (CVE-2015-0225)

The default configuration in Apache Cassandra running on the remote host version 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 bound an unauthenticated JMX/RMI interface to all network interfaces. A remote attacker able to access the RMI, an API for the transport and remote execution of serialized Java, could use this flaw to execute arbitrary code as the user running Cassandra.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Jake Luciani reports :

Under its default configuration, Cassandra binds an unauthenticated JMX/RMI interface to all network interfaces. As RMI is an API for the transport and remote execution of serialized Java, anyone with access to this interface can execute arbitrary code as the running user.

Mitigation :

1.2.x has reached EOL, so users of <= 1.2.x are recommended to upgrade to a supported version of Cassandra, or manually configure encryption and authentication of JMX, (see https://wiki.apache.org/cassandra/JmxSecurity).

2.0.x users should upgrade to 2.0.14

2.1.x users should upgrade to 2.1.4

Alternately, users of any version not wishing to upgrade can reconfigure JMX/RMI to enable encryption and authentication according to https://wiki.apache.org/cassandra/JmxSecurityor http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent .html

Credit :

This issue was discovered by Georgi Geshev of MWR InfoSecurity

ID	Name	Product	Family	Severity
419782	SCA: security update for org.apache.cassandra:apache-cassandra (GHSA-w7f2-gjxf-2gm9)	Tenable Cloud Security	SCA Checks	critical
419782	SCA: security update for org.apache.cassandra:apache-cassandra (GHSA-w7f2-gjxf-2gm9)	Tenable Self-Hosted Container Security	SCA Checks	critical
143420	Apache Cassandra 1.2.x <= 1.2.19 / 2.0.x <= 2.0.13 / 2.1.x <= 2.1.3 RCE	Nessus	Databases	critical
83796	FreeBSD : cassandra -- remote execution of arbitrary code (607f4d44-0158-11e5-8fda-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-0225

critical

Tenable Plugins

critical

critical

critical

high