APP: Redis XAUTOCLAIM command COUNT Integer Overflow

This signature detects attempts to exploit a known vulnerability against Redis. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the server.

Extended Description

Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. This has been patched in Redis version 7.0.5. No known workarounds exist.

Affected Products

Redis redis

References

CVE: CVE-2023-22458

URL: https://github.com/redis/redis/security/advisories/GHSA-mrcw-fhw9-fj8j https://github.com/redis/redis/security/advisories/GHSA-r8w2-2m53-gprj

Short Name

APP:REDIS-XAUTOCLAIM-CMD

Severity

Major

Recommended

False

Recommended Action

Drop

APP: Redis XAUTOCLAIM command COUNT Integer Overflow

Extended Description

Affected Products

References

Found a potential security threat?