Redis Cache Poisoner

CRLF injection is a web security vulnerability that occurs when an attacker can inject carriage return (CR, ) and line feed (LF, ) characters into application input that is used to construct protocol commands. When this vulnerability exists in applications that interact with Redis, it becomes a powerful attack vector for cache poisoning, session hijacking, and privilege escalation through arbitrary Redis command injection.

Understanding CRLF Injection in Redis

Redis uses a text-based protocol called RESP (Redis Serialization Protocol) where commands are separated by CRLF sequences. When an application constructs Redis commands by concatenating user input without sanitizing CRLF characters, an attacker can terminate the intended command prematurely and inject additional Redis commands. This is similar in principle to SQL injection, but targets the Redis protocol instead of SQL queries. Any application that builds Redis commands through string concatenation rather than using parameterized clients is potentially vulnerable.

Cache Poisoning Attack Techniques

Cache poisoning through Redis command injection allows attackers to write arbitrary key-value pairs into the cache. In applications that store session data in Redis, this can lead to session hijacking or privilege escalation. By injecting commands like SET session:admin_token, an attacker can create or overwrite session data to impersonate privileged users. Other attack scenarios include poisoning cached HTML content to deliver malicious scripts, modifying application configuration stored in Redis, or using EVAL commands to execute Lua scripts on the Redis server.

Real-World Impact and Prevention

CRLF injection vulnerabilities affecting caching systems have been found in production applications across various industries. The consequences range from data tampering to complete application compromise. Prevention requires using Redis client libraries that properly handle command parameterization, sanitizing all user input for CRLF characters before incorporating it into any protocol commands, and implementing access controls on Redis instances. Security professionals must understand these attack patterns to effectively identify them during penetration testing engagements.