CVE-2023-28859: Redis-py Information Disclosure Flaw

CVE-2023-28859 Overview

CVE-2023-28859 is an information leakage vulnerability in redis-py, the popular Python client library for Redis. The vulnerability affects versions before 4.4.4 and 4.5.x before 4.5.4. When an asynchronous Redis command is canceled at an inopportune time, the library fails to properly close the connection, potentially allowing response data to be sent to the client of an unrelated request. This issue specifically impacts AsyncIO connections and can occur during non-pipeline operations.

Critical Impact

Sensitive data from one Redis operation may inadvertently leak to unrelated client requests due to improper connection cleanup, potentially exposing confidential information across different user sessions or application contexts.

Affected Products

• redis-py versions before 4.4.4
• redis-py versions 4.5.x before 4.5.4
• Applications using AsyncIO Redis connections with the affected library versions

Discovery Timeline

• March 26, 2023 - CVE-2023-28859 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-28859

Vulnerability Analysis

This vulnerability stems from improper resource cleanup (CWE-459) in the redis-py library's AsyncIO implementation. When an asynchronous Redis command is canceled—such as through a timeout or explicit cancellation—the underlying connection is not properly closed or reset. This leaves the connection in an inconsistent state where response data from one request can be erroneously routed to a completely different client request.

The issue is particularly concerning in multi-tenant applications or services handling requests from multiple users, where data isolation is critical. An attacker or unrelated user could potentially receive sensitive data intended for another party without any active exploitation—the vulnerability can trigger through normal application behavior when request cancellations occur.

Root Cause

The root cause is classified as CWE-459 (Incomplete Cleanup). The redis-py library's AsyncIO connection handling does not properly clean up connection state when a Redis command is canceled. Specifically, when an async operation is interrupted, the connection remains open and in an indeterminate state. The next request that uses this connection may then receive the response data that was originally intended for the canceled request, leading to cross-request data contamination.

Attack Vector

The vulnerability is exploitable over the network. An attacker with low privileges (authenticated access to the application) could potentially exploit this vulnerability to gain access to sensitive information from other users' Redis operations. The attack does not require user interaction and can occur passively when the race condition between request cancellation and response delivery manifests.

The exploitation scenario involves:

1. A legitimate user initiates an async Redis command
2. The command is canceled (timeout, application logic, or explicit cancellation)
3. The connection remains open with pending response data
4. A subsequent unrelated request receives the orphaned response data

This can expose cached session data, authentication tokens, user preferences, or any other information stored in Redis.

Detection Methods for CVE-2023-28859

Indicators of Compromise

• Unexpected data appearing in Redis responses that doesn't match the requested keys
• Application logs showing data type mismatches or deserialization errors from Redis responses
• User reports of seeing other users' data or receiving incorrect cached information
• Elevated rates of async task cancellations in application monitoring

Detection Strategies

• Implement application-level validation to verify that Redis responses match expected data formats and request contexts
• Monitor for anomalous patterns in Redis connection pool behavior, particularly connection reuse after cancellations
• Review application logs for Redis-related errors that may indicate response/request mismatches
• Audit dependency manifests to identify vulnerable redis-py versions across all services

Monitoring Recommendations

• Enable detailed logging for AsyncIO task cancellations involving Redis operations
• Implement data integrity checks on Redis responses to detect potential cross-contamination
• Monitor connection pool metrics for unusual connection lifecycle patterns
• Set up alerts for dependency vulnerability scanners that flag redis-py versions below 4.4.4 or 4.5.4

How to Mitigate CVE-2023-28859

Immediate Actions Required

• Upgrade redis-py to version 4.4.4 or later for the 4.4.x branch
• Upgrade redis-py to version 4.5.4 or later for the 4.5.x branch
• Review and audit any AsyncIO-based Redis usage in your applications
• Consider implementing additional application-level validation on Redis responses until patching is complete

Patch Information

The redis-py maintainers have released patched versions that address the data leakage across AsyncIO connections. The fixes are available in:

• redis-py version 4.4.4
• redis-py version 4.5.4

Additional technical details about the fix can be found in the GitHub Pull Request #2641 and Pull Request #2666. The original issue report provides context on the vulnerability discovery.

Workarounds

• Avoid using async cancellation with Redis operations where possible until patches are applied
• Implement connection pool configurations that create new connections rather than reusing potentially tainted ones
• Add application-level response validation to detect and discard responses that don't match expected data patterns
• Consider temporarily using synchronous Redis operations for sensitive data if async patching is delayed

# Upgrade redis-py to patched version
pip install --upgrade redis>=4.5.4

# Verify installed version
pip show redis | grep Version

# For requirements.txt, update to:
# redis>=4.5.4