Redis-RESP Parser Uncaught RangeError Vulnerability

Executive Summary

This vulnerability involves the redis-parser library failing to validate large array lengths in RESP protocol data. Attackers can send a maliciously crafted Redis response with an excessively large declared length (above 2^32-1), causing a RangeError when the parser attempts to preallocate an array. This leads to an uncaught exception that crashes the Node.js client process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in Node.js applications using node-redis-parser when processing Redis responses. Check logs for RangeError exceptions related to array allocation. Use network monitoring tools to inspect Redis protocol responses for malformed multi-bulk lengths exceeding 2^32-1, such as headers like *99999999999\r\n.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause denial of service by crashing the Node.js application using the redis-parser library. A malicious Redis endpoint could exploit this to terminate the client process, disrupting services that rely on Redis communication. It may also lead to potential memory corruption or arbitrary code execution in some scenarios.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by crashing the Node.js client process, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could interrupt systems managing protected health information, potentially violating access controls or audit requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update node-redis-parser to a patched version that enforces a maximum array length limit and validates input. Wrap parser execution in try-catch blocks to prevent process termination. Validate Redis responses at network boundaries to block malformed multi-bulk lengths.

Useful 0 Not Useful 0