CVE-2025-23015
📋 TL;DR
This vulnerability allows users with MODIFY permission on all keyspaces in Apache Cassandra to escalate privileges to superuser by performing unsafe actions on system resources. It affects all Apache Cassandra deployments running vulnerable versions (through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2). Organizations granting broad data modification permissions are particularly at risk.
💻 Affected Systems
- Apache Cassandra
📦 What is this software?
Cassandra by Apache
Cassandra by Apache
Cassandra by Apache
Cassandra by Apache
Cassandra by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete cluster compromise where an attacker gains superuser privileges, enabling full control over all data, configuration, and potentially lateral movement to connected systems.
Likely Case
Privilege escalation leading to unauthorized data access, modification, or deletion across all keyspaces in the Cassandra cluster.
If Mitigated
Limited impact if proper least-privilege access controls are implemented and MODIFY permission on all keyspaces is not granted to untrusted users.
🎯 Exploit Status
Requires authenticated access with MODIFY permission on all keyspaces. Exploitation involves specific unsafe actions against system resources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3
Vendor Advisory: https://lists.apache.org/thread/jmks4msbgkl65ssg69x728sv1m0hwz3s
Restart Required: No
Instructions:
1. Identify your Cassandra version using 'nodetool version'. 2. Download and install the patched version from Apache Cassandra downloads. 3. Follow standard Cassandra upgrade procedures for your version. 4. Verify the upgrade with 'nodetool version'.
🔧 Temporary Workarounds
Restrict MODIFY permissions
allRemove MODIFY permission on all keyspaces from users who don't absolutely need it. Implement least-privilege access controls.
REVOKE MODIFY ON ALL KEYSPACES FROM username;
GRANT MODIFY ON KEYSPACE specific_keyspace TO username;
🧯 If You Can't Patch
- Immediately audit and remove MODIFY permission on all keyspaces from all non-essential users
- Implement network segmentation to isolate Cassandra clusters and restrict access to trusted users only
🔍 How to Verify
Check if Vulnerable:
Check Cassandra version with 'nodetool version'. If version is 3.0.30 or earlier, 3.11.17 or earlier, 4.0.15 or earlier, 4.1.7 or earlier, or 5.0.2 or earlier, you are vulnerable.Check Version:
nodetool versionVerify Fix Applied:
After upgrading, run 'nodetool version' to confirm you're running 3.0.31+, 3.11.18+, 4.0.16+, 4.1.8+, or 5.0.3+.📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts in Cassandra system.log
- Multiple MODIFY permission grants on all keyspaces
- Suspicious system resource access patterns
Network Indicators:
- Unusual CQL traffic patterns from users with MODIFY permissions
- Multiple privilege-related queries from single sources
SIEM Query:
source="cassandra.log" AND ("MODIFY ON ALL KEYSPACES" OR "privilege escalation" OR "system resource access")