Executive brief
RansomLook is a ransomware tracking and intelligence platform that maintains a database of threat group information and ransom activities. An unauthenticated attacker can exploit a glob pattern injection vulnerability in the API to bypass input validation, allowing them to enumerate sensitive data (including private groups and market information) and potentially delete data belonging to other torrents through crafted requests.
Technical details
The vulnerability is a Redis glob pattern injection caused by insufficient input sanitization in multiple endpoints. When user-supplied input (such as group names or blockchain identifiers) fails to match known values, the application directly interpolates the attacker-controlled value into Redis SCAN MATCH patterns without escaping glob metacharacters (*, ?, [, ]). This allows attackers to broaden SCAN operations beyond their intended scope. The /api/health/<name> endpoint is vulnerable to enumeration attacks; /api/crypto/chain/<chain> exhibits the same flaw; and the delete_manual_torrent() function's use of attacker-influenced infohash values creates a destructive sink where arbitrary torrent-health data could be deleted. No authentication is required to exploit the enumeration variants. The patch escapes user-controlled glob characters before Redis interpolation and removes unsafe fallback behavior.
Affected products
- RansomLook RansomLook
Timeline
- 2026-08-24: disclosed