DataStax Enterprise 6.8 exposed to pre-auth RCE via Gremlin
Default unauthenticated Gremlin Server plus a Groovy sandbox bypass lets remote attackers run OS commands as the dse user.
A critical pre-authentication remote code execution flaw in DataStax Enterprise (DSE) 6.8.49 can hand an unauthenticated attacker full control of the host and its database services.
DSE runs a Gremlin Server for graph queries. In the default configuration that service accepts connections without authentication, relying on a Groovy sandbox that only constrains the top-level script. Nested script evaluation escapes that sandbox, so a crafted request can execute arbitrary operating system commands as the dse user. The 0day Rubbish Research Team disclosed the issue, rated it CVSS 9.8, and published a proof of concept.
Consequences include full filesystem and configuration access as the service account, arbitrary command execution, and takeover of the DSE host. Operators running DSE 6.8 with Gremlin exposed under default settings should assume remote compromise is possible until authentication is required and the sandbox weakness is mitigated.