CVE-2023-42809
📋 TL;DR
CVE-2023-42809 is a critical deserialization vulnerability in Redisson Java Redis client that allows remote code execution. Attackers who can redirect clients to a malicious Redis server can send specially crafted objects that, when deserialized, execute arbitrary code on the client machine. This affects all Redisson users prior to version 3.22.0 who communicate with untrusted Redis servers.
💻 Affected Systems
- Redisson
📦 What is this software?
Redisson by Redisson
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the client machine with full remote code execution, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Remote code execution leading to data theft, service disruption, or lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation and allowlisting, potentially only denial of service if deserialization fails safely.
🎯 Exploit Status
Exploitation requires the attacker to control or redirect Redis server communications. Public proof-of-concept exists in GitHub advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.22.0
Vendor Advisory: https://github.com/redisson/redisson/commit/fe6a2571801656ff1599ef87bdee20f519a5d1fe
Restart Required: Yes
Instructions:
1. Update Redisson dependency to version 3.22.0 or later. 2. For Maven: Update pom.xml to <version>3.22.0</version>. 3. For Gradle: Update build.gradle to implementation 'org.redisson:redisson:3.22.0'. 4. Rebuild and redeploy application. 5. Restart affected services.
🔧 Temporary Workarounds
Use Safe Codec Configuration
allConfigure SerializationCodec with explicit allowlist of allowed classes for deserialization
new SerializationCodec(classLoader, allowedClassesSet)
Avoid Kryo5Codec
allDo not use Kryo5Codec as it remains vulnerable even after patching
// Use KryoCodec instead of Kryo5Codec
🧯 If You Can't Patch
- Implement network controls to ensure Redisson clients only communicate with trusted Redis servers
- Use allowlisting with SerializationCodec constructor to restrict deserializable classes
🔍 How to Verify
Check if Vulnerable:
Check Redisson version in dependency files (pom.xml, build.gradle) or runtime with Redisson.getVersion()Check Version:
Redisson.getVersion() or check dependency manifest filesVerify Fix Applied:
Confirm Redisson version is 3.22.0 or higher and verify codec configurations avoid Kryo5Codec📡 Detection & Monitoring
Log Indicators:
- Java deserialization errors
- Unexpected ClassNotFoundException
- Suspicious network connections to Redis
Network Indicators:
- Unusual outbound connections from Java applications to Redis servers
- Redis protocol traffic to unexpected destinations
SIEM Query:
source="*redisson*" AND (event="deserialization_error" OR event="ClassNotFoundException")🔗 References
- https://github.com/redisson/redisson/commit/fe6a2571801656ff1599ef87bdee20f519a5d1fe
- https://securitylab.github.com/advisories/GHSL-2023-053_Redisson/
- https://github.com/redisson/redisson/commit/fe6a2571801656ff1599ef87bdee20f519a5d1fe
- https://securitylab.github.com/advisories/GHSL-2023-053_Redisson/
