CVE-2021-44521: 
Apache Cassandra vulnerability analysis and mitigation

CVE-2021-44521 is a high-severity remote code execution vulnerability in Apache Cassandra, discovered by Omer Kaspi of the JFrog Security vulnerability research team. The vulnerability affects Apache Cassandra versions 3.0.x before 3.0.26, 3.11.x before 3.11.12, and 4.0.x before 4.0.2. The issue exists when specific non-default configuration options are enabled, allowing attackers with sufficient permissions to execute arbitrary code on the host system (JFrog Blog, SecurityWeek).

The vulnerability occurs when Cassandra is configured with three specific settings in the cassandra.yaml file: enableuserdefinedfunctions: true, enablescripteduserdefinedfunctions: true, and enableuserdefinedfunctions_threads: false. The issue stems from the implementation of user-defined functions (UDFs) using the Nashorn JavaScript engine, which is not guaranteed to be secure when accepting untrusted code. When UDF threads are disabled, the functions run in the Cassandra daemon thread with elevated permissions, allowing attackers to disable the security manager and escape the sandbox. The vulnerability has received a CVSS v3.1 base score of 9.1 (CRITICAL) (NVD, JFrog Blog).

Successful exploitation of this vulnerability could lead to complete system compromise, allowing attackers to execute arbitrary code on the host system. The impact is particularly severe for organizations using Cassandra in their infrastructure, including major companies like Netflix, Twitter, Reddit, and Cisco (SecurityWeek, Hacker News).

Apache has released patched versions to address this vulnerability: users should upgrade to version 3.0.26 (for 3.0.x users), 3.11.12 (for 3.11.x users), or 4.0.2 (for 4.0.x users). The fix adds a new flag 'allowextrainsecureudfs' (false by default) which prevents turning off the security manager. Alternative mitigations include setting enableuserdefinedfunctionsthreads to true (the default setting) or completely disabling UDFs by setting enableuserdefinedfunctions to false (JFrog Blog, OSS Security).