CVE-2024-31449
📋 TL;DR
This vulnerability allows authenticated Redis users to trigger a stack buffer overflow via specially crafted Lua scripts, potentially leading to remote code execution. All Redis installations with Lua scripting enabled are affected. The vulnerability exists in the bit library of Redis's Lua implementation.
💻 Affected Systems
- Redis
📦 What is this software?
Redis by Redis
Redis by Redis
Redis by Redis
Redis by Redis
Redis by Redis
⚠️ Risk & Real-World Impact
Worst Case
Authenticated attacker gains remote code execution with Redis process privileges, potentially leading to full system compromise.
Likely Case
Denial of service through Redis crash or limited code execution within Redis process context.
If Mitigated
No impact if Redis is patched or if Lua scripting is disabled for untrusted users.
🎯 Exploit Status
Requires authenticated access and Lua script execution privileges. Exploit requires crafting specific bit operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.16, 7.2.6, or 7.4.1
Vendor Advisory: https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5
Restart Required: Yes
Instructions:
1. Identify current Redis version. 2. Backup Redis data. 3. Stop Redis service. 4. Install patched version (6.2.16, 7.2.6, or 7.4.1). 5. Start Redis service. 6. Verify version and functionality.
🔧 Temporary Workarounds
Disable Lua scripting for untrusted users
allRemove EVAL command execution privileges from untrusted Redis users
redis-cli ACL SETUSER <username> -@all +@read +@write -eval
🧯 If You Can't Patch
- Restrict Redis access to trusted networks only using firewall rules
- Implement strict Redis ACLs to limit Lua script execution to trusted users only
🔍 How to Verify
Check if Vulnerable:
Check Redis version: if version is below 6.2.16, 7.2.6, or 7.4.1, system is vulnerable.Check Version:
redis-cli --versionVerify Fix Applied:
Confirm Redis version is 6.2.16, 7.2.6, or 7.4.1 or higher after patching.📡 Detection & Monitoring
Log Indicators:
- Unusual Lua script execution patterns
- Redis crashes or abnormal terminations
- Large number of bit operation commands
Network Indicators:
- Unusual EVAL command usage from untrusted sources
- Multiple failed Lua script executions
SIEM Query:
source="redis" AND (command="EVAL" OR command="EVALSHA") AND user!="trusted_user"