CVE-2025-23015: Apache Cassandra Privilege Escalation

CVE-2025-23015 Overview

CVE-2025-23015 is a Privilege Escalation vulnerability affecting Apache Cassandra, a widely-deployed distributed NoSQL database. The vulnerability exists due to privilege definitions with unsafe actions, allowing a user with MODIFY permission ON ALL KEYSPACES to escalate their privileges to superuser status within a targeted Cassandra cluster via unsafe actions to a system resource.

This flaw is classified under CWE-267 (Privilege Defined With Unsafe Actions), indicating that the authorization mechanism grants certain permissions that can be abused to perform actions beyond the intended scope.

Critical Impact

Users with data MODIFY permissions on all keyspaces can escalate to superuser privileges, potentially gaining complete administrative control over the Cassandra cluster including access to all data, configuration changes, and the ability to compromise cluster integrity.

Affected Products

• Apache Cassandra through version 3.0.30
• Apache Cassandra through version 3.11.17
• Apache Cassandra through version 4.0.15
• Apache Cassandra through version 4.1.7
• Apache Cassandra through version 5.0.2

Discovery Timeline

• February 4, 2025 - CVE-2025-23015 published to NVD
• July 14, 2025 - Last updated in NVD database

Technical Details for CVE-2025-23015

Vulnerability Analysis

The vulnerability stems from how Apache Cassandra defines and enforces privileges related to MODIFY operations on keyspaces. When a user is granted MODIFY permission ON ALL KEYSPACES, the permission scope inadvertently extends to system resources that should be protected.

The core issue is that the privilege model does not adequately distinguish between user data keyspaces and critical system keyspaces. This design oversight allows authenticated users with seemingly limited data modification rights to interact with internal system tables in ways that enable privilege escalation.

The attack can be executed over the network by any authenticated user who has been granted MODIFY permissions on all keyspaces, which is a common configuration in many Cassandra deployments where operators grant broad permissions for operational convenience.

Root Cause

The root cause is a privilege boundary violation in Apache Cassandra's authorization framework. The MODIFY permission, when granted at the ALL KEYSPACES scope, does not properly exclude system-level resources from its scope. This allows users to perform unsafe actions against system tables that control user roles and permissions, ultimately enabling escalation to superuser status.

The authorization check fails to enforce a clear separation between user data operations and administrative operations on system keyspaces, violating the principle of least privilege.

Attack Vector

An attacker with valid credentials and MODIFY permission ON ALL KEYSPACES can exploit this vulnerability by:

1. Authenticating to the Cassandra cluster with their existing credentials
2. Identifying system keyspaces and tables that control role/permission assignments
3. Using their MODIFY permissions to alter system resource entries
4. Escalating their own privileges to superuser level
5. Gaining complete administrative control over the Cassandra cluster

The vulnerability requires network access to the Cassandra cluster and valid authentication credentials with MODIFY permissions on all keyspaces. The exploitation does not require user interaction and the attack complexity is low once the prerequisites are met.

Detection Methods for CVE-2025-23015

Indicators of Compromise

• Unexpected modifications to system keyspaces, particularly system_auth tables
• User accounts suddenly gaining superuser privileges without administrative action
• Audit log entries showing MODIFY operations against system tables from non-administrative users
• Unusual CQL queries targeting system keyspace tables from users with limited intended permissions

Detection Strategies

• Enable and monitor Cassandra audit logging for all operations against system keyspaces
• Implement alerting for any permission changes or role modifications in the system_auth keyspace
• Review access control lists to identify users with MODIFY ON ALL KEYSPACES permissions
• Deploy database activity monitoring solutions to detect anomalous modification patterns

Monitoring Recommendations

• Configure Cassandra audit logging to capture all authentication and authorization events
• Set up automated alerts for privilege escalation patterns and superuser role assignments
• Regularly audit user permissions to identify overly broad MODIFY grants
• Monitor for queries targeting system_auth.roles and system_auth.role_permissions tables

How to Mitigate CVE-2025-23015

Immediate Actions Required

• Review all user accounts with MODIFY permission ON ALL KEYSPACES immediately
• Audit the system_auth keyspace for unauthorized modifications to roles and permissions
• Restrict MODIFY permissions to specific keyspaces rather than ALL KEYSPACES where possible
• Implement network segmentation to limit access to Cassandra cluster nodes
• Enable audit logging if not already configured to track permission-related activities

Patch Information

Apache has released patched versions that address this privilege escalation vulnerability. Organizations should upgrade to the following fixed versions:

• Version 3.0.31 (fixes versions through 3.0.30)
• Version 3.11.18 (fixes versions through 3.11.17)
• Version 4.0.16 (fixes versions through 4.0.15)
• Version 4.1.8 (fixes versions through 4.1.7)
• Version 5.0.3 (fixes versions through 5.0.2)

For detailed patch information, refer to the Apache Mailing List Thread and the NetApp Security Advisory.

Workarounds

• Remove MODIFY ON ALL KEYSPACES grants and replace with explicit grants on specific user keyspaces
• Implement additional authorization controls using Cassandra's role-based access control (RBAC)
• Deploy network-level access controls to restrict who can connect to Cassandra nodes
• Consider implementing a proxy layer that filters and validates CQL commands before execution
• Regularly audit and rotate credentials for accounts with elevated permissions

# Review users with MODIFY ON ALL KEYSPACES
# Run this CQL query to list role permissions
cqlsh -e "SELECT * FROM system_auth.role_permissions WHERE resource = 'data';"

# Revoke overly broad permissions (example)
# REVOKE MODIFY ON ALL KEYSPACES FROM 'username';

# Grant specific keyspace permissions instead
# GRANT MODIFY ON KEYSPACE user_data TO 'username';