RedisSearch up to 2.0 on Redis FT.SEARCH/FT.AGGREGATE LIMIT/KNN heap-based overflow

Summaryinfo

A vulnerability was found in RedisSearch up to 2.0 on Redis. It has been rated as critical. Impacted is the function FT.SEARCH/FT.AGGREGATE of the component Redis Module. The manipulation of the argument LIMIT/KNN leads to heap-based overflow. This vulnerability is documented as CVE-2024-51737. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in RedisSearch up to 2.0 on Redis. This issue affects the function FT.SEARCH/FT.AGGREGATE of the component Redis Module. The manipulation of the argument LIMIT/KNN with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

RediSearch is a Redis module that provides querying, secondary indexing, and full-text search for Redis. An authenticated redis user executing FT.SEARCH or FT.AGGREGATE with a specially crafted LIMIT command argument, or FT.SEARCH with a specially crafted KNN command argument, can trigger an integer overflow, leading to heap overflow and potential remote code execution. This vulnerability is fixed in 2.6.24, 2.8.21, and 2.10.10. Avoid setting value of -1 or large values for configuration parameters MAXSEARCHRESULTS and MAXAGGREGATERESULTS, to avoid exploiting large LIMIT arguments.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-51737 since 10/31/2024. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 2.6.24, 2.8.21 or 2.10.10 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• RedisSearch

Version

• 2.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion