JFrog’s Security Research team has identified a critical vulnerability affecting Apache’s popular Cassandra open-source NoSQL distributed database that could be exploited to allow attackers to read or manipulate sensitive data, and ultimately perform remote code execution (RCE). The Cassandra database allows for the creation of user-defined-functions (UDFs), giving the users the ability to customize the way the database processes information. The flaw, tracked as CVE-2021-44521, stems from the creation of UDFs for custom processing that are written in JavaScript, which defaults to the Nashorn engine in the Java Runtime Environment (JRE), and gives access to arbitrary Java classes. The problem is that the Nashorn engine cannot guarantee security when untrusted code is accepted unless the execution is wrapped in a sandbox environment. In their writeup, JFrog states that through manipulating the Cassandra configuration options, they were able to abuse Nashorn, escape the wrapped sandbox environment, and ultimately achieve the remote execution of arbitrary code. Given that the PoC exploit was unsuccessful against default distributions of Cassandra, it is less likely that this exploit will be as impactful as it could be, but given its popularity, there will still be many vulnerable distributions. Apache has officially patched this flaw, and JFrog researchers recommend that administrators upgrade to one of the three (3) stable versions or perform the manual mitigation techniques listed in the JFrog writeup.