NetWitness Platform: Redis Multiple Vulnerabilities

[#1]

This advisory addresses recent vulnerabilities identified in Redis package. The specific vulnerabilities are CVE-2024-31449, CVE-2024-31227 and CVE-2024-31228. These vulnerabilities could potentially allow remote code execution (RCE) and denial of service (DoS) due to improper input validation and access control configurations.

• CVE-2024-31449: This vulnerability allows authenticated users to execute crafted Lua scripts, leading to potential remote code execution (RCE). This can compromise the confidentiality, integrity, and availability of the Redis instance.
• CVE-2024-31228: This vulnerability enables denial-of-service (DoS) conditions through unbounded pattern matching in commands like KEYS and SCAN, which could crash the server.
• CVE-2024-31227: This vulnerability results from malformed Access Control List (ACL) selectors that can trigger a server panic, also leading to DoS.

CVE Identifier

CVE-2024-31449, CVE-2024-31227, CVE-2024-31228

Severity

CVE ID	Package Impacted	NVD Severity	Comment
CVE-2024-31449	redis:6/redis	Major	Affects only UEBA
CVE-2024-31227	redis:6/redis	Moderate	Not Applicable
CVE-2024-31228	redis:6/redis	Moderate	Affects only UEBA

Summary and Impact Analysis for NetWitness

Despite these vulnerabilities, our NetWitness is not significantly impacted due to the current ACL configuration that effectively restricts access. However, it is crucial to note that these vulnerabilities are relevant only to the UEBA appliance of our application.

Note: If a customer is not using the UEBA appliance, they are not vulnerable to any of these vulnerabilities.

Potential for Exploitation

Exploitation of these vulnerabilities requires an authenticated user with access to the Redis instance. The conditions for successful exploitation include:

• Use of Redis version 6.2.7, which is vulnerable.
• The current ACL configuration (`user default on nopass ~* &* +@all`) does not enforce strong password protection or command restrictions.
• Only authenticated users can exploit these CVEs.

Given that our NetWitness implements additional security measures beyond the default Redis configuration, the chances of exploitation are significantly reduced. However, if an attacker gain authenticated access, the risk remains substantial.

Level of Risk Incurred and Introduced

There is minimal risk incurred by NetWitness from the vulnerabilities CVE-2024-31449, CVE-2024- 31227, and CVE-2024-31228, as only the UEBA appliance utilizes Redis.

• CVE-2024-31449: Moderate risk due to potential RCE capabilities if exploited. Only authenticated users can perform the exploitation, and a specially crafted payload is required.
• CVE-2024-31228: Moderate risk as it could lead to service disruption for UEBA but does not compromise data integrity.
• CVE-2024-31227: No risk, as NetWitness uses a non-vulnerable version of Redis.

Affected Versions

Version 12.5 and earlier:

Mitigation Steps

Fix for the identified vulnerabilities will be included in a subsequent version of the product as soon as it becomes available from Red Hat.

To enhance security, please ensure that network access to the UEBA server is restricted to trusted IP addresses only..

EOPS Policy

Netwitness has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.

Legal Information

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this advisory, contact RSA Customer Support. RSA Security LLC and its affiliates distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information.

RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without

a warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement.

In no event shall RSA, its affiliates or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or its suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.