CVE-2021-29469: Node-Redis ReDoS in monitor mode

Executive brief

Node-Redis is a popular software library used by Node.js applications to communicate with Redis databases. A flaw in how the library processes monitoring messages allows an attacker to send specially crafted data that causes the application to freeze or crash. This results in a denial of service, potentially disrupting application availability and business operations.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Node-Redis due to an inefficient regular expression used in 'monitor mode'. The 'monitor_regex' in 'lib/utils.js' contains patterns that can trigger exponential backtracking when processing specifically crafted monitor messages. An attacker capable of influencing the strings processed by a client in monitor mode can cause high CPU consumption, leading to a denial of service. The issue is fixed in version 3.1.1 by simplifying the regular expression to avoid catastrophic backtracking.

Affected products

• Node-Redis redis >= 2.6.0, < 3.1.1

Timeline

• 2021-04-13: patched: Version 3.1.1 released
• 2021-04-23: disclosed: NVD and GitHub Advisory published

References

• https://github.com/NodeRedis/node-redis/security/advisories/GHSA-35q2-47q7-3pc3
• https://github.com/NodeRedis/node-redis/commit/2d11b6dc9b9774464a91fb4b448bad8bf699629e
• https://github.com/NodeRedis/node-redis/releases/tag/v3.1.1
• https://security.netapp.com/advisory/ntap-20210611-0010