📄 الوصف (الإنجليزية)
Cassandra Web 0.5.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating path traversal parameters. Attackers can exploit the disabled Rack::Protection module to read sensitive system files like /etc/passwd and retrieve Apache Cassandra database credentials.
🤖 ملخص AI
CVE-2020-36939 is a critical directory traversal vulnerability in Cassandra Web 0.5.0 that allows unauthenticated attackers to read arbitrary files from the system, including sensitive credentials and configuration files. The vulnerability exploits a disabled Rack::Protection module, enabling attackers to bypass path validation mechanisms. While no public exploit is currently available, the vulnerability poses significant risk to organizations running vulnerable Cassandra Web instances, particularly those exposing the interface to untrusted networks.
📄 الوصف (العربية)
🤖 التحليل الذكي آخر تحليل: Apr 30, 2026 01:20
🇸🇦 التأثير على المملكة العربية السعودية
This vulnerability poses significant risk to Saudi organizations utilizing Apache Cassandra for data management, particularly in banking sector (SAMA-regulated institutions), government agencies (NCA oversight), healthcare providers, and energy sector (ARAMCO and subsidiaries). The ability to read arbitrary files including database credentials could lead to unauthorized access to critical data repositories. Saudi financial institutions and government entities storing sensitive citizen data are at highest risk. Telecommunications companies (STC, Mobily) managing customer databases could also be impacted. The vulnerability is particularly dangerous as it requires no authentication and could be exploited remotely if Cassandra Web is exposed.
🏢 القطاعات السعودية المتأثرة
Banking and Financial Services
Government and Public Administration
Healthcare and Medical Services
Energy and Utilities
Telecommunications
Data Centers and Cloud Services
Enterprise IT Infrastructure
🎯 تقنيات MITRE ATT&CK
⚖️ درجة المخاطر السعودية (AI)
8.2
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Identify all instances of Cassandra Web 0.5.0 in your environment using network scanning and asset inventory tools
2. Immediately restrict network access to Cassandra Web interfaces using firewall rules - limit to trusted administrative networks only
3. Disable or remove Cassandra Web if not actively required for operations
PATCHING GUIDANCE:
1. Upgrade Cassandra Web to version 0.6.0 or later immediately
2. Verify patch installation by checking application version in web interface
3. Test functionality in staging environment before production deployment
COMPENSATING CONTROLS (if immediate patching not possible):
1. Implement Web Application Firewall (WAF) rules to block path traversal attempts (../, ..\, encoded variants)
2. Deploy reverse proxy with strict input validation in front of Cassandra Web
3. Enable Rack::Protection module manually if possible through configuration
4. Implement network segmentation to isolate Cassandra Web from untrusted networks
5. Monitor access logs for suspicious path patterns
DETECTION RULES:
1. Monitor HTTP requests containing: ../, ..\, %2e%2e, encoded traversal sequences
2. Alert on requests to sensitive paths: /etc/passwd, /etc/shadow, /proc/, /sys/
3. Track failed authentication attempts followed by directory traversal attempts
4. Monitor for unusual file read patterns in application logs
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. تحديد جميع نسخ Cassandra Web 0.5.0 في بيئتك باستخدام أدوات المسح والجرد
2. تقييد الوصول الفوري إلى واجهات Cassandra Web باستخدام قواعد جدار الحماية - حصر الوصول للشبكات الإدارية الموثوقة فقط
3. تعطيل أو إزالة Cassandra Web إذا لم تكن مطلوبة للعمليات
إرشادات التصحيح:
1. ترقية Cassandra Web إلى الإصدار 0.6.0 أو أحدث فوراً
2. التحقق من تثبيت التصحيح بفحص إصدار التطبيق في الواجهة
3. اختبار الوظائف في بيئة التجريب قبل النشر الإنتاجي
الضوابط البديلة (إذا لم يكن التصحيح الفوري ممكناً):
1. تنفيذ قواعد جدار تطبيقات الويب لحجب محاولات اجتياز المسارات
2. نشر وكيل عكسي مع التحقق الصارم من المدخلات
3. تفعيل وحدة Rack::Protection يدوياً إن أمكن
4. تنفيذ تقسيم الشبكة لعزل Cassandra Web
5. مراقبة سجلات الوصول للأنماط المريبة
قواعد الكشف:
1. مراقبة طلبات HTTP التي تحتوي على: ../, ..\, %2e%2e
2. التنبيه على الطلبات للمسارات الحساسة: /etc/passwd, /etc/shadow
3. تتبع محاولات المصادقة الفاشلة متبوعة بمحاولات اجتياز المسارات
4. مراقبة أنماط قراءة الملفات غير العادية
📋 خريطة الامتثال التنظيمي
🟢 NCA ECC 2024
5.1.1 - Access Control and Authentication
5.2.1 - Information Security Policies
5.3.1 - Cryptography and Data Protection
5.4.1 - Incident Management
5.5.1 - Vulnerability Management
🔵 SAMA CSF
Governance - Risk Management Framework
Protect - Access Control
Protect - Data Protection
Detect - Monitoring and Logging
Respond - Incident Response
🟡 ISO 27001:2022
A.5.1 - Policies for information security
A.6.1 - Internal organization
A.8.1 - Asset management
A.9.1 - Access control
A.12.6 - Management of technical vulnerabilities
A.14.2 - Information security requirements analysis and specification
🟣 PCI DSS v4.0.1
Requirement 1 - Firewall configuration
Requirement 2 - Default security parameters
Requirement 6 - Secure development and vulnerability management
Requirement 11 - Security testing and monitoring
🔗 المراجع والمصادر 4
🔗
🔗
🔗
🔗
https://github.com/avalanche123/cassandra-web
disclosure@vulncheck.com
https://rubygems.org/gems/cassandra-web/versions/0.5.0
disclosure@vulncheck.com
https://www.exploit-db.com/exploits/49362
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/cassandra-web-remote-file-read
disclosure@vulncheck.com