CVE-2024-51741

Executive Summary

CVE-2024-51741 is a denial-of-service (DoS) vulnerability in Redis, an open-source in-memory data structure store. An authenticated attacker with sufficient privileges can craft a malformed ACL (Access Control List) selector. When this selector is accessed by the server, it triggers a server panic, leading to a crash and subsequent denial of service. The vulnerability affects Redis versions prior to 7.2.7 and 7.4.2. The CVSS score is 4.4 (Medium), with a local attack vector and high privileges required. No public proof-of-concept (PoC) or exploit code is currently available. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

Redis is widely distributed as a standalone server, container image (e.g., Docker), and through package managers (e.g., apt, yum, brew). Organizations using Redis in their infrastructure should verify their version and apply the patch immediately. While this is not a supply chain vulnerability in the traditional sense (e.g., malicious package injection), the risk of unpatched Redis instances being exploited remains. Ensure that all Redis deployments, including those in CI/CD pipelines, development environments, and production, are updated to the patched versions.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the Redis server.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit.
• Privileges Required (PR): High (H) – The attacker must have authenticated access with sufficient privileges to create ACL selectors.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The server crashes, causing a denial of service.

Threat Level: Medium. While the CVSS score is moderate, the impact on availability is high. The requirement for high privileges reduces the likelihood of exploitation by external attackers, but insider threats or compromised accounts with high privileges pose a significant risk.

Deep Dive & Mechanics

The vulnerability resides in Redis's ACL (Access Control List) subsystem. ACLs in Redis allow administrators to define fine-grained access control rules for different users. An ACL selector is a component of an ACL rule that specifies the commands and keys a user can access.

The flaw occurs when a malformed ACL selector is created. The exact nature of the malformation is not publicly disclosed, but it likely involves an edge case in parsing or validation logic. When the Redis server attempts to process this malformed selector (e.g., during authentication or command execution), it triggers a null pointer dereference or an assertion failure, leading to a server panic and crash.

The crash is a classic denial-of-service scenario. An attacker with the ability to create or modify ACL rules (i.e., a user with the +acl permission or the default admin user) can intentionally craft a malicious selector. Once the selector is stored and subsequently accessed (e.g., when a user tries to authenticate or execute a command), the server crashes.

The fix in versions 7.2.7 and 7.4.2 likely involves adding input validation or bounds checking to prevent the malformed selector from being created or processed.

Vulnerable vs. Patched Code

The exact code change is not publicly available, but the following is a conceptual comparison.

Vulnerable Code (Conceptual):

// In ACL selector parsing function
int parseACLSelector(char *input, ACLSelector *selector) {
    // Assume input is always valid
    selector->type = getSelectorType(input);
    selector->pattern = strdup(input + 2); // Potential buffer overflow or null pointer
    // No validation of input length or content
    return 0;
}

Patched Code (Conceptual):

// In ACL selector parsing function
int parseACLSelector(char *input, ACLSelector *selector) {
    if (input == NULL || strlen(input) < 3) {
        return -1; // Invalid input
    }
    selector->type = getSelectorType(input);
    if (selector->type == UNKNOWN) {
        return -1; // Unknown type
    }
    selector->pattern = strdup(input + 2);
    if (selector->pattern == NULL) {
        return -1; // Memory allocation failure
    }
    // Additional validation of pattern
    return 0;
}

The patched code adds input validation and error handling to prevent the malformed selector from being processed.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to a Redis server (version < 7.2.7 or < 7.4.2)
• Authenticated user with +acl permission or admin privileges

Steps:

1. Connect to the Redis server using redis-cli.
2. Authenticate with a privileged user:

   redis-cli -h target -p 6379
   AUTH myadmin mypassword
   

3. Create a malformed ACL selector. The exact payload is unknown, but a hypothetical example:

   ACL SETUSER attacker on >password +@all ~* &* +acl
   ACL SETUSER attacker on >password +@all ~* &* +acl -@dangerous
   

   The malformed selector might be introduced via a crafted ACL SETUSER command with an invalid pattern.
4. Trigger the selector by having any user (including the attacker) attempt to authenticate or execute a command that causes the server to evaluate the ACL:

   AUTH attacker password
   

5. The server crashes, causing a denial of service.

Note: No public exploit code is available. This is a theoretical exploitation path.

Blue Team (Defense & Detection)

Detection:

• Monitor Redis logs for crashes or panics:

  # Redis log example
  === REDIS BUG REPORT START ===
  ...
  === REDIS BUG REPORT END ===
  

• Monitor for unusual ACL modifications:

  # Monitor ACL changes in Redis
  redis-cli MONITOR | grep "ACL SETUSER"
  

• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade to Redis 7.2.7 or 7.4.2.
• Restrict ACL modification privileges to only trusted administrators.
• Implement network segmentation to limit access to Redis servers.
• Use Redis's RENAME_COMMAND to rename dangerous commands like ACL to a less guessable name.

Indicators of Compromise (IOCs)

• Log Entries:
  • Redis crash logs containing "=== REDIS BUG REPORT START ==="
  • Repeated server restarts
• Network Traffic:
  • Unusual ACL SETUSER commands in Redis traffic
• System State:
  • Redis process unexpectedly terminating
  • Core dump files in the Redis working directory
• File System:
  • Modified Redis configuration files (e.g., redis.conf) with new ACL rules

Detection Engineering

YARA Rule

rule CVE_2024_51741_Redis_ACL_DoS {
    meta:
        description = "Detects malformed ACL selectors in Redis configuration or log files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-51741"
    strings:
        $acl_selector = /ACL\s+SETUSER\s+\w+\s+on\s+>.*\s+~.*\s+&.*\s+\+acl/i
        $malformed_pattern = /[^\x20-\x7E]/ // Non-printable characters in ACL
    condition:
        $acl_selector and #malformed_pattern > 0
}

Sigma Rule

title: CVE-2024-51741 Redis ACL DoS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-51741 via malformed ACL selectors
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-51741
logsource:
    category: application
    product: redis
detection:
    selection:
        EventID: 2001 # Redis log event for ACL changes
        Message|contains: "ACL SETUSER"
    condition: selection
falsepositives:
    - Legitimate ACL modifications by administrators
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 6379 (msg:"CVE-2024-51741 Redis ACL DoS Attempt"; flow:to_server,established; content:"ACL SETUSER"; nocase; content:"+acl"; nocase; distance:0; within:100; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Redis: Update to version 7.2.7 or 7.4.2 immediately.

   # For Debian/Ubuntu
   sudo apt-get update && sudo apt-get install redis-server=7.2.7
   # For Red Hat/CentOS
   sudo yum update redis
   # For Docker
   docker pull redis:7.2.7
   

2. Restrict ACL Privileges: Limit the ability to create or modify ACL rules to only essential personnel.
3. Monitor Logs: Enable and monitor Redis logs for crashes or unusual ACL activity.

Long-Term Mitigations:

• Implement the principle of least privilege for all Redis users.
• Use Redis's RENAME_COMMAND to obscure dangerous commands:

  RENAME_COMMAND ACL MY_SECRET_ACL_COMMAND
  

• Deploy Redis behind a firewall or VPN to limit network exposure.
• Regularly audit ACL configurations for anomalies.
• Implement intrusion detection systems (IDS) with the provided Suricata rules.

Valters IT