CVE-2023-47003
📋 TL;DR
A NULL pointer dereference vulnerability in RedisGraph allows attackers to execute arbitrary code or cause denial of service by sending a specially crafted string to the DataBlock_ItemIsDeleted function. This affects all RedisGraph deployments running vulnerable versions, particularly those exposed to untrusted user input.
💻 Affected Systems
- RedisGraph
📦 What is this software?
Redisgraph by Redislabs
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Denial of service causing RedisGraph service crashes and application downtime.
If Mitigated
Limited impact with proper network segmentation and input validation controls.
🎯 Exploit Status
The vulnerability requires sending crafted queries to RedisGraph, which typically accepts unauthenticated connections by default.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RedisGraph v2.12.11 or later
Vendor Advisory: https://github.com/RedisGraph/RedisGraph/issues/3063
Restart Required: Yes
Instructions:
1. Stop RedisGraph service. 2. Update RedisGraph to version 2.12.11 or later. 3. Restart RedisGraph service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to RedisGraph to only trusted sources
iptables -A INPUT -p tcp --dport 6379 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -j DROP
Disable RedisGraph Module
allTemporarily disable RedisGraph module if not essential
redis-cli MODULE UNLOAD RedisGraph
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit RedisGraph access
- Deploy Web Application Firewall (WAF) or Redis proxy with input validation
🔍 How to Verify
Check if Vulnerable:
Check RedisGraph version with 'redis-cli GRAPH.QUERY g "RETURN 1"' and verify version in response or logsCheck Version:
redis-cli INFO modules | grep RedisGraphVerify Fix Applied:
Confirm RedisGraph version is 2.12.11 or later and test with known safe queries📡 Detection & Monitoring
Log Indicators:
- RedisGraph crash logs
- Segmentation fault errors
- Abnormal query patterns with crafted strings
Network Indicators:
- Unusual query patterns to RedisGraph port
- Multiple connection attempts with malformed data
SIEM Query:
source="redis.log" AND ("segmentation fault" OR "crash" OR "DataBlock_ItemIsDeleted")