Executive Summary

The Bitnami Cassandra container images have a vulnerability where the default superuser account 'cassandra:cassandra' remains active even after a custom administrator account is configured using the CASSANDRA_USER environment variable.

This happens because the container initialization script sometimes fails to remove the built-in default superuser account, leaving an unintended access path open.

As a result, an attacker can authenticate using the default credentials and gain full superuser privileges on the Cassandra database.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to gain full superuser access to the Cassandra database without any privileges or user interaction.

• Complete access to keyspaces and tables.
• Ability to modify cluster topology.
• High impact on confidentiality, integrity, and availability of the database.

Because of the low attack complexity and no required privileges, this vulnerability poses a critical security risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the default superuser account cassandra:cassandra is still active on your Bitnami Cassandra container, even after configuring a custom administrator account via the CASSANDRA_USER environment variable.

A practical way to verify this is to connect to the Cassandra CQL shell and query the existing superuser accounts.

• Use the CQL shell command to list users and check if the default 'cassandra' user still exists: `SELECT * FROM system_auth.roles WHERE role = 'cassandra';`
• Attempt to authenticate using the default credentials (username: cassandra, password: cassandra) to see if access is granted.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the Bitnami Cassandra container images to the patched versions: 4.0.20-photon-5-r7, 4.1.11-photon-5-r7, or 5.0.8-photon-5-r4 / 5.0.8-debian-12-r3.

If upgrading is not immediately possible, manually drop the default 'cassandra' superuser account using the CQL shell as a temporary workaround.

• Connect to the CQL shell and execute: `DROP ROLE cassandra;`

Additionally, restrict network access to the Cassandra CQL port (9042) to limit exposure to remote attackers.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote attackers to gain full superuser privileges by exploiting the retained default cassandra:cassandra account, which can lead to unauthorized access and modification of sensitive data.

Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over data confidentiality, integrity, and availability.

Failure to properly secure superuser accounts and prevent unintended access paths may result in violations of these regulations, leading to legal and financial consequences.

Useful 0 Not Useful 0