{"record":{"id":"5f25b2e06fee5acb","repo":"shadow1ng/fscan","slug":"authentication-required","errorCode":null,"errorMessage":"authentication required","messagePattern":"authentication required","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/cassandra.go","lineNumber":126,"sourceCode":"\n\t// Step 2: 读取响应\n\topcode, body, err := cqlRecv(conn)\n\tif err != nil {\n\t\tstate.IncrementTCPFailedPacketCount()\n\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}\n\t}\n\n\t// READY → 已就绪，发送测试查询\n\t// AUTHENTICATE → 需要认证\n\t// ERROR → 错误\n\tif opcode == cqlOpError {\n\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: fmt.Errorf(\"cassandra error: %s\", string(body))}\n\t}\n\n\t// Step 3: 如果需要认证\n\tif opcode == cqlOpAuthChl {\n\t\tif cred.Username == \"\" && cred.Password == \"\" {\n\t\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: fmt.Errorf(\"authentication required\")}\n\t\t}\n\t\t// SASL PLAIN: \\x00username\\x00password\n\t\tsaslToken := []byte(\"\\x00\" + cred.Username + \"\\x00\" + cred.Password)\n\t\tif err := cqlSend(conn, cqlOpAuthRsp, saslToken); err != nil {\n\t\t\tstate.IncrementTCPFailedPacketCount()\n\t\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}\n\t\t}\n\t\topcode, body, err = cqlRecv(conn)\n\t\tif err != nil {\n\t\t\tstate.IncrementTCPFailedPacketCount()\n\t\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeNetwork, Error: err}\n\t\t}\n\t\t// AUTH_SUCCESS → 认证成功\n\t\t// ERROR → 认证失败\n\t\tif opcode == cqlOpError {\n\t\t\treturn &AuthResult{Success: false, ErrorType: ErrorTypeAuth, Error: fmt.Errorf(\"authentication failed: %s\", string(body))}\n\t\t}\n\t\tif opcode != cqlOpAuthOk && opcode != cqlOpReady {","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/cassandra.go#L108-L144","documentation":"The Cassandra server responded with an AUTHENTICATE frame (cqlOpAuthChl), meaning credentials are required, but the candidate credential had an empty username and empty password. doCassandraAuth stops with 'authentication required' and ErrorTypeAuth.","triggerScenarios":"doCassandraAuth receives opcode cqlOpAuthChl after STARTUP while cred.Username == \"\" && cred.Password == \"\", i.e. an anonymous/no-auth attempt against a server that demands auth.","commonSituations":"Testing a cluster with authenticator: PasswordAuthenticator (or CassandraAuthenticator) using blank credentials; credential list accidentally contains an empty entry; assuming AllowAllAuthenticator when the server requires login.","solutions":["Provide valid username/password credentials (default cassandra/cassandra on unmodified installs) so the SASL PLAIN exchange can run.","Remove empty credential entries from the credential set if anonymous access is not intended.","If the cluster truly allows anonymous access, set authenticator to AllowAllAuthenticator in cassandra.yaml — otherwise this error is expected for blank creds."],"exampleFix":"// before\ncred := Credential{Username: \"\", Password: \"\"}\n// after\ncred := Credential{Username: \"cassandra\", Password: \"cassandra\"}","handlingStrategy":"validation","validationCode":"if cred.Username == \"\" && cred.Password == \"\" {\n    // server requires auth; skip blank-cred attempt\n    return\n}","typeGuard":null,"tryCatchPattern":"res := doCassandraAuth(conn, cred, state)\nif !res.Success && res.ErrorType == ErrorTypeAuth && res.Error.Error() == \"authentication required\" {\n    log.Printf(\"%s requires credentials; retest with valid creds\", target)\n}","preventionTips":["Filter empty credential pairs out of the credential list before testing.","Remember Cassandra with PasswordAuthenticator always requires login — never assume anonymous access.","Include default credentials (cassandra/cassandra) in the test set for unmodified installs."],"tags":["cassandra","authentication","sasl","credentials"],"backgroundTag":"authentication-required","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}