CVE-2018-8016: Missing Authentication for Critical Function in Apache Cassandra
Summary
CVE-2018-8016: Missing Authentication for Critical Function in Apache Cassandra. Affects org.apache.cassandra:cassandra-all versions >= 3.8, < 3.11.2. Fixed in 3.11.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Cassandra is an open-source distributed database management system designed to handle large amounts of data across multiple commodity servers. It provides high availability and scalability without compromising performance. The vulnerability in question affects versions 3.8 through 3.11.1 of Apache Cassandra. These versions bind an unauthenticated JMX/RMI interface to all network interfaces, allowing remote attackers to execute arbitrary Java code via an RMI request. This vulnerability is a regression of CVE-2015-0225, which was previously fixed. The regression was introduced in the CASSANDRA-12109 issue and subsequently fixed in the CASSANDRA-14173 issue. The fix is included in the 3.11.2 release of Apache Cassandra.
Vulnerability Detail
The vulnerability arises from the default configuration of Apache Cassandra, which exposes an unauthenticated JMX/RMI interface to all network interfaces. This allows remote attackers to exploit the interface and execute arbitrary Java code by sending an RMI request. The impact of this vulnerability is critical, as it grants unauthorized access to the target system and enables the execution of arbitrary code. The vulnerability has a CVSSv3 score of 9.8, indicating its severity.
How To Fix
Minimum fixed version
3.11.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the JMX/RMI interface or restrict access to it by configuring appropriate firewall rules. Disabling the interface will prevent remote exploitation of the vulnerability. However, this may impact the functionality of certain management and monitoring tools that rely on JMX/RMI. It is important to consider the implications before implementing this workaround.
Conclusion
The vulnerability in Apache Cassandra (CVE-2018-8016) exposes an unauthenticated JMX/RMI interface, allowing remote attackers to execute arbitrary Java code. Upgrading to version 3.11.2 or later is the recommended solution to fix this vulnerability. Alternatively, users can implement a temporary workaround by disabling or restricting access to the JMX/RMI interface. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cassandra:cassandra-all →
FAQ
Apache Cassandra is an open-source distributed database management system designed to handle large amounts of data across multiple commodity servers. It provides high availability and scalability without compromising performance.
The vulnerability allows remote attackers to execute arbitrary Java code by exploiting the unauthenticated JMX/RMI interface. This grants unauthorized access to the target system and enables the execution of arbitrary code.
To fix this vulnerability, it is recommended to upgrade to Apache Cassandra version 3.11.2 or later. This version includes the fix for the regression and ensures that the JMX/RMI interface requires authentication for critical functions.
As a temporary workaround, users can disable the JMX/RMI interface or restrict access to it by configuring appropriate firewall rules. However, this may impact the functionality of certain management and monitoring tools that rely on JMX/RMI.
The CVSSv3 score of this vulnerability is 9.8, indicating its severity.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cassandra:cassandra-all.
