Goal

Detect successful exploits of the CQL injection vulnerability.

Strategy

Monitor CQL injection patterns and Cassandra queries executed.
When a match is detected (that is, when the malicious pattern is found in a query as functional tokens: @appsec.security_activity:vulnerability_trigger.cassandra), those specific requests are highlighted.

The signal severity is determined based on whether the application threw an error when processing the CQL queries.

• CRITICAL An CQL injection vulnerability was exploited and impacts the system. The attackers might have exfiltrated data, tampered with your databases, or taken over the server.
• HIGH An CQL injection vulnerability has been triggered. However, the application threw a CQL exception during execution indicating they might not have succeeded at impacting the system.

Triage and response

1. Consider blocking the attacking IPs temporarily to slow down the further exploitation of your infrastructure.
2. Leverage traces to determine the vulnerable queries, and fix the code.
3. Investigate your database servers’ logs to figure out the extent of the exploit.