IBM DataStage on Cloud Pak for Data Redis Key Write Vulnerability

Executive Summary

This vulnerability allows an unauthenticated user to write arbitrary data into a shared Redis database under any tenant's key in IBM DataStage on Cloud Pak for Data 5.4.0.0. This breaks the platform's security boundary for credential encryption and lets an anonymous attacker modify cached flow parameters for any tenant.

Useful 0 Not Useful 0

Detection Guidance

Detection requires checking for unauthorized Redis write access. Monitor Redis logs for suspicious writes to shared keys or tenant-specific keys. Use Redis CLI commands like 'INFO keyspace' to check key patterns and 'MONITOR' to track real-time commands. Ensure no anonymous users have write permissions in Redis configuration.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to poison cached credentials or flow parameters, leading to unauthorized access, data breaches, or service disruption. Since the attack requires no authentication, any external user can potentially compromise the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. It undermines encryption boundaries and could lead to unauthorized data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Apply IBM-provided patches or updates for IBM DataStage on Cloud Pak for Data 5.4.0.0 immediately. Isolate affected systems if possible and restrict network access to Redis services. Review and rotate all tenant credentials and cached flow parameters stored in Redis.

Useful 0 Not Useful 0