redis-store deserialisiert nicht vertrauenswürdige Daten

The vulnerability stems from the redis-store gem's handling of data retrieved from Redis. An attacker who can inject malicious data into Redis can then trigger the loading of this data as an unsafe object within the ruby application. This could allow them to execute arbitrary code with the privileges of the ruby process, effectively gaining control of the server. The blast radius extends to any data stored in Redis that is subsequently processed by the application, making it a high-severity risk. Successful exploitation could lead to data breaches, denial of service, or complete system takeover.

Ruby applications that rely on the redis-store gem for data persistence are at risk. This includes web applications, background workers, and any other Ruby processes using Redis as a data store. Specifically, applications with weak Redis access controls or those that do not properly validate data stored in Redis are particularly vulnerable.

• ruby / gem: Check gem versions using gem list redis-store. If the version is ≤1.3.0, the system is vulnerable. • ruby / application: Review application code for any instances where data is loaded from Redis using redis-store and not properly validated. • generic web: Monitor Redis logs for unusual activity or attempts to inject data. Look for patterns indicative of malicious payloads. • database (redis): Use redis-cli to inspect the contents of Redis keys. Look for unexpected or suspicious data structures.

1. 2017-12-06Disclosure

   disclosure

1. Veröffentlicht2017-12-06
2. Geändert2024-02-16
3. EPSS aktualisiert2026-04-02

The primary mitigation is to upgrade to redis-store version 1.4.0 or later, which addresses the unsafe object loading issue. If immediate upgrade is not possible due to compatibility concerns or breaking changes, consider implementing a temporary workaround by carefully validating all data retrieved from Redis before processing it within the application. Implement strict input validation and sanitization routines to prevent malicious data from being stored in Redis in the first place. Monitor Redis logs for unusual activity or attempts to inject unexpected data. After upgrading, confirm the fix by attempting to load a known malicious object from Redis and verifying that it is properly handled and does not result in code execution.