Executive brief
redis-srvr is a Node.js package for managing Redis server instances. The package downloads an executable over an unencrypted HTTP connection, allowing attackers with network access (such as on compromised networks or through ISP-level interception) to inject malicious code and gain complete system control on the affected machine.
Technical details
The vulnerability stems from CWE-311 (Missing Encryption of Sensitive Data): redis-srvr downloads a critical executable over HTTP without TLS/HTTPS protection. An attacker in a privileged network position (man-in-the-middle) can intercept the HTTP response and replace the legitimate executable with a malicious binary. This results in arbitrary code execution with the privileges of the user running redis-srvr. The attack requires network proximity or ISP-level access and occurs during package installation/runtime. No patch has been released since the package's last update in 2014, making mitigation dependent on package replacement or network isolation.
Affected products
- npm redis-srvr <=2.8.17-beta.6
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database
- 2014: other: Last package update