CVE-2023-30601: Improper Privilege Management

May 30, 2023 (updated June 5, 2023)

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1.

WORKAROUND The vulnerability requires nodetool/JMX access to be exploitable, disable access for any non-trusted users.

MITIGATION Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditlog configuration property allow_nodetool_archive_command as false.

References

lists.apache.org/thread/f74p9jdhmmp7vtrqd8lgm8bq3dhxl8vn
nvd.nist.gov/vuln/detail/CVE-2023-30601

Code Behaviors & Features

Detect and mitigate CVE-2023-30601 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →