CVE-2026-78378 in RansomLook
Summary
by MITRE • 08/24/2026
Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns.
The /api/health/<name> endpoint attempted to resolve the supplied name to a known group or market, but when resolution failed it fell back to using the attacker-controlled value directly in a Redis key pattern. An unauthenticated attacker could therefore supply Redis glob metacharacters such as *, ?, [ or ] to broaden the SCAN operation beyond the intended group. For example, requesting /api/health/* could enumerate health information, mirror slugs, and uptime series belonging to all groups and markets, including entities marked as private.
Similar unsafe interpolation was present in /api/crypto/chain/<chain> and in the delete_manual_torrent() function. The latter represents a potentially destructive sink because a crafted infohash containing glob metacharacters could cause the scan to match torrent-health keys belonging to other torrents if attacker-controlled input can reach that function.
The patch removes the unsafe fallback from the health endpoint and introduces glob escaping for user-controlled values before they are incorporated into Redis SCAN MATCH expressions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
Ransomlook, a software component often associated with ransomware operations or data leak sites, contains a critical security flaw classified as a Redis Glob Pattern Injection vulnerability. This issue stems from insufficient neutralization of user-supplied input prior to its incorporation into Redis SCAN MATCH commands. The core technical failure lies in the application's handling of fallback logic within specific API endpoints. When resolving a supplied name to a known group or market identifier, the system fails if no match is found and subsequently defaults to using the raw, attacker-controlled value directly as part of the Redis key pattern. This design oversight allows an unauthenticated actor to inject Redis glob metacharacters such as asterisks, question marks, square brackets, and closing brackets into these patterns. By doing so, the scope of the SCAN operation is artificially broadened beyond the intended single entity, enabling unauthorized data enumeration across multiple groups and markets.
The operational impact of this vulnerability is severe due to the potential for extensive information disclosure. An attacker can exploit endpoints like /api/health/* to enumerate sensitive health metrics, mirror slugs, and uptime series belonging to all entities within the system, including those explicitly marked as private or restricted. This capability effectively bypasses access controls that rely on specific key matching rather than authentication checks at the data retrieval layer. The vulnerability is not isolated to a single endpoint; similar unsafe interpolation mechanisms were identified in /api/crypto/chain/ and within the delete_manual_torrent() function. In the context of torrent management, this flaw presents a potentially destructive sink condition where crafted infohashes containing glob metacharacters could cause SCAN operations to match health keys belonging to unrelated torrents. If attacker-controlled input can reach this deletion logic, it may lead to unintended data corruption or mass deletion of records associated with other users' activities.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) specifically manifesting as command injection via pattern matching parameters, and is closely related to CWE-78 Improper Neutralization of Special Elements used in an OS Command where the special elements are interpreted by the Redis server. In terms of offensive security frameworks, this exploitation technique maps to ATT&CK T1005 Data from Local System which involves accessing local data sources without remote execution tools, and potentially T1213 Data from Information Repositories if the attacker leverages the enumerated keys for further lateral movement or exfiltration planning. The vulnerability highlights a common architectural weakness where application-level logic assumes that fallback values are safe to use in query construction without sanitization, ignoring the semantic difference between literal string matching and pattern-based searching in key-value stores like Redis.
To mitigate this risk, developers must implement strict input validation and output encoding for all user-supplied data before it is concatenated into Redis commands. The patch addressing this issue removes the unsafe fallback mechanism entirely from the health endpoint, ensuring that invalid inputs do not result in broad scans. Furthermore, the solution introduces glob escaping functions to neutralize special characters such as *, ?, [, ], and \ within user-controlled values prior to their incorporation into SCAN MATCH expressions. This ensures that metacharacters are treated as literal data rather than pattern operators. Security practitioners should also consider implementing authentication checks at the API level for sensitive endpoints, enforcing least-privilege access controls on Redis keys, and conducting regular code reviews focused on query construction patterns in NoSQL databases to prevent similar injection vectors in other parts of the application stack.