RedisTimeSeries Invalid Memory Access Vulnerability in RESTORE Command Leading to Remote Code Execution

A vulnerability exists in all RedisTimeSeries versions prior to 1.12.14, where the module fails to properly validate serialized data in the context of the Redis RESTORE command. This flaw allows an authenticated attacker with permission to use RESTORE to send a crafted payload that can cause invalid memory access, potentially leading to remote code execution on the server. The issue arises from inadequate validation of serialized values, allowing malformed inputs to disrupt memory safety.

Impact

Exploitation of this vulnerability can result in invalid memory access, with the potential for remote code execution on the affected Redis server, in the context of the server process. This could lead to a complete compromise of the system, allowing unauthorized execution of code, access to sensitive data, or disruption of services.

Remediation

Users can upgrade to RedisTimeSeries version 1.12.14 or later to address this vulnerability. For those unable to immediately upgrade, it is recommended to apply ACL rules to restrict access to the RESTORE command.