RedisBloom Invalid Memory Access in RESTORE Command Leading to Remote Code Execution

A vulnerability exists in all versions of RedisBloom prior to 2.8.20. The issue arises from improper validation of serialized values in the Redis RESTORE command, allowing authenticated attackers with permission to use RESTORE to send crafted payloads that trigger invalid memory access. This could result in remote code execution on the server. The vulnerability can be mitigated by applying ACL rules to restrict access to the RESTORE command.

Impact

Exploitation of this vulnerability can lead to invalid memory access, with potential consequences including remote code execution on the affected system.

Remediation

Users can upgrade to RedisBloom version 2.8.20 or apply ACL rules to restrict access to the RESTORE command.