CVE-2024-31449

Executive Summary

CVE-2024-31449 is a critical stack buffer overflow vulnerability in Redis, an open-source in-memory database. An authenticated attacker can exploit this flaw by executing a specially crafted Lua script that triggers a buffer overflow in the bit library. This can lead to remote code execution (RCE) on the Redis server. The vulnerability affects all versions of Redis with Lua scripting enabled. The official fix is available in Redis versions 6.2.16, 7.2.6, and 7.4.1. No public proof-of-concept (PoC) or exploit code has been released at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the potential impact is severe.

Supply Chain & Package Security

Redis is widely used as a dependency in many applications and services. Organizations using Redis as a package (e.g., via npm, PyPI, or Docker) should immediately update to the patched versions. The vulnerability is in the core Redis binary, not in a specific package manager, but any system running an affected Redis version is at risk.

CVSS Breakdown & Threat Level

• CVSS Score: 7.0 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Although authentication is required, the low complexity and high impact make this a serious threat for environments where Redis is exposed to authenticated users.

Deep Dive & Mechanics

The vulnerability resides in the bit library of Redis, which is used for bitwise operations on strings. When a Lua script is executed, Redis processes the script using its embedded Lua interpreter. The bit library functions do not properly validate the size of input data, leading to a stack buffer overflow when a crafted script is executed.

Root Cause: The bit library uses fixed-size stack buffers for temporary storage. By providing a Lua script that triggers a specific sequence of bit operations with oversized or specially crafted arguments, an attacker can overflow the stack buffer. This overwrites adjacent memory, including the return address, allowing for arbitrary code execution.

Attack Vector: An authenticated user sends a Lua script via the EVAL or EVALSHA command. The script contains malicious bit operations that cause the overflow.

Impact: Successful exploitation allows the attacker to execute arbitrary code in the context of the Redis process, potentially leading to full server compromise.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In bit.c (vulnerable version)
void bit_op(char *buf, size_t len) {
    char stack_buf[256]; // Fixed-size buffer
    // No bounds check on len
    memcpy(stack_buf, buf, len); // Stack overflow if len > 256
}

Patched Code (Conceptual):

// In bit.c (patched version)
void bit_op(char *buf, size_t len) {
    if (len > 256) {
        // Handle large input safely, e.g., use heap allocation
        char *heap_buf = malloc(len);
        if (!heap_buf) return;
        memcpy(heap_buf, buf, len);
        // ... process
        free(heap_buf);
    } else {
        char stack_buf[256];
        memcpy(stack_buf, buf, len);
        // ... process
    }
}

The patched version adds a bounds check and uses heap allocation for large inputs, preventing the stack overflow.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Redis instance with Lua scripting enabled (default).
• Valid authentication credentials (or Redis configured without auth, which is common in internal networks).

Lab Setup:

1. Deploy a vulnerable Redis instance (e.g., Redis 7.2.5) using Docker:

   docker run -d --name redis-vuln -p 6379:6379 redis:7.2.5
   

2. Connect to the Redis instance:

   redis-cli -h 127.0.0.1 -p 6379
   

Exploit Concept (No public PoC available): The exploit would involve crafting a Lua script that triggers the overflow. A hypothetical example:

-- Hypothetical exploit script
local large_string = string.rep("A", 1000)
redis.call("SET", "key", large_string)
-- Trigger bit operation that causes overflow
redis.call("BITOP", "AND", "dest", "key", "key")

This script would need to be refined to achieve code execution. Since no public exploit exists, this is for educational purposes only.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual Lua script execution, especially scripts with large string operations.
• Enable Redis audit logging to capture all EVAL and EVALSHA commands.
• Use network monitoring to detect anomalous traffic to Redis port 6379.

Defense:

• Immediately upgrade to patched Redis versions (6.2.16, 7.2.6, 7.4.1).
• Restrict access to Redis using firewalls and authentication.
• Disable Lua scripting if not required (rename-command EVAL "" in redis.conf).
• Implement least privilege for Redis users.

Indicators of Compromise (IOCs)

• Network: Unusual Lua scripts sent to Redis port 6379.
• Logs: Redis logs showing repeated EVAL or EVALSHA commands with large payloads.
• Process: Redis process crash or abnormal memory usage.
• File System: Unexpected files written by the Redis process (if RCE achieved).
• Registry/Config: Changes to Redis configuration to disable security controls.

Detection Engineering

YARA Rule

rule CVE_2024_31449_Redis_Lua_Overflow {
    meta:
        description = "Detects Lua scripts attempting to exploit CVE-2024-31449 in Redis"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-31449"
    strings:
        $lua_cmd = "EVAL" nocase
        $bit_op = "BITOP" nocase
        $large_str = /string\.rep\s*\([^)]{100,}\)/  // Large string repetition
    condition:
        $lua_cmd and $bit_op and $large_str
}

Sigma Rule

title: Redis Lua Script Exploitation Attempt (CVE-2024-31449)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2024-31449 via Lua scripts
author: Valters IT
logsource:
    category: application
    product: redis
detection:
    selection:
        EventID: "EVAL" or "EVALSHA"
        ScriptContent|contains: "BITOP"
        ScriptContent|re: "string\\.rep\\([^)]{100,}\\)"
    condition: selection
falsepositives:
    - Legitimate use of large bit operations
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 6379 (msg:"CVE-2024-31449 Redis Lua Script Exploit Attempt"; flow:to_server,established; content:"EVAL"; nocase; content:"BITOP"; nocase; pcre:"/string\.rep\s*\([^)]{100,}\)/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Redis to version 6.2.16, 7.2.6, or 7.4.1 (or later).
2. If upgrade is not possible, disable Lua scripting by renaming the EVAL command:

   rename-command EVAL ""
   rename-command EVALSHA ""
   

3. Restrict network access to Redis using firewalls and VPNs.
4. Enable authentication with strong passwords.

Long-Term Measures:

• Regularly update Redis to the latest stable version.
• Monitor Redis logs for suspicious activity.
• Implement a Web Application Firewall (WAF) to filter malicious Lua scripts.
• Conduct regular security audits and penetration testing.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact Valters IT.