Loophole Analysis of Apache Cassandra RMI re-binding

This article introduces the vulnerability analysis of Apache Cassandra RMI re-binding, the content is very detailed, interested friends can refer to, hope to be helpful to you.

Brief introduction of 0x01 vulnerability

2020-09-02, 360CERT Monitoring found that Apache officially issued a risk notice for Apache Cassandra RMI rebinding vulnerabilities, the vulnerability number is CVE-2020-13946, vulnerability level: medium danger, vulnerability score: 6.8points.

In Apache Cassandra, a local attacker who does not have access to the Apache Cassandra process or configuration file can manipulate the RMI registry to perform a man-in-the-middle attack and obtain the username and password used to access the JMX interface, which can then be used by the attacker to access the JMX interface and perform unauthorized operations.

In this regard, 360CERT recommends that users upgrade Apache Cassandra to the latest version in time, which can be downloaded from:

Downloading Cassandra

Https://cassandra.apache.org/download/

At the same time, please do a good job of asset self-examination and prevention to avoid hacker attacks.

0x02 risk rating

360CERT's assessment of the vulnerability is as follows

Assessment method level threat level medium risk impact surface general 360CERT score 6.80x03 vulnerability details

Apache Cassandra (generally referred to as C* in the community) is an open source distributed NoSQL database system. Originally developed by Facebook, it is used to improve the search performance of e-mail systems in simple format data, integrating Google BigTable's data model with Amazon Dynamo's fully distributed architecture.

In Apache Cassandra, a local attacker who does not have access to the Apache Cassandra process or configuration file can manipulate the RMI registry to perform a man-in-the-middle attack and obtain the username and password used to access the JMX interface, which can then be used by the attacker to access the JMX interface and perform unauthorized operations.

Users should also pay attention to `Apache Cassandra CVE-2019-2684`, which is a vulnerability of `JRE`. Through the vulnerability of `JRE`-2684`, the rebinding vulnerability of `JRE` can be remotely exploited.

0x04 affects version

-Apache Cassandra 2.1.x: