Elastic high stable eql

Cassandra JavaScript UDF Creation

Identifies Cassandra Query Language statements that create a JavaScript user-defined function. On vulnerable and dangerously configured Cassandra servers, adversaries can abuse scripted UDF creation to escape the JavaScript sandbox and execute operating-system commands, including through CVE-2021-44521.

View Source

Detection Logic

any where data_stream.dataset == "network_traffic.cassandra" and
    network_traffic.cassandra.request.query like~ "*create*function*" and
    network_traffic.cassandra.request.query like~ "*language*javascript*"

False Positives

⚠ Developers or database administrators may deploy approved JavaScript UDFs in environments where scripted functions are intentionally enabled. Validate the function body, client address, Cassandra version, configuration, and change window before escalating.

Field Validations

Loading…

Comments (0)

Loading comments...