CVE-2024-51737

What it actually does

Authenticated user triggers integer overflow via crafted LIMIT argument to FT.SEARCH/FT.AGGREGATE or KNN argument to FT.SEARCH, resulting in heap overflow and potential remote code execution.

Why it matters to the business

Compromise of Redis search instances allows attackers to execute arbitrary code, exfiltrate or alter indexed data, and disrupt search-dependent applications; high ecosystem prevalence of Redis modules increases blast radius for organizations relying on RediSearch.

How an attack unfolds

An authenticated Redis user issues FT.SEARCH or FT.AGGREGATE commands containing oversized or negative LIMIT values, or FT.SEARCH with malicious KNN arguments, exploiting insufficient bounds checks to cause integer overflow, subsequent heap corruption, and arbitrary code execution.

How to fix it

Upgrade RediSearch to version 2.6.24, 2.8.21, or 2.10.10 (or redisearch/redisearch GIT commit 4700446acf8abf8261b13ea8982c8c96af57a265); if upgrade is delayed, set MAXSEARCHRESULTS and MAXAGGREGATERESULTS to safe bounded values instead of -1 or large numbers.

How to confirm the fix worked

Verify installed RediSearch module version against fixed releases; attempt reproduction with controlled LIMIT and KNN arguments in a test environment and confirm absence of crashes or overflows; review configuration for MAXSEARCHRESULTS and MAXAGGREGATERESULTS settings.

Typical attack path

1. Obtain authenticated Redis access with module privileges
2. Craft FT.SEARCH or FT.AGGREGATE command using LIMIT set to -1 or extreme value
3. Alternatively craft FT.SEARCH with malicious KNN argument
4. Trigger integer overflow leading to heap overflow
5. Achieve remote code execution on the Redis host

How to detect it

Review Redis command logs and slow-log entries for FT.SEARCH and FT.AGGREGATE invocations containing LIMIT or KNN arguments with suspiciously large or negative numeric values; correlate with process crashes or unexpected Redis restarts.

What your security team should do

• Immediately upgrade all RediSearch instances to a fixed version
• Audit and restrict Redis user permissions to limit FT.SEARCH/FT.AGGREGATE usage
• Apply configuration hardening to bound MAXSEARCHRESULTS and MAXAGGREGATERESULTS
• Monitor for unusual command patterns until patches are deployed