CVE-2024-44805: Redis Quota Cache Overwrite via PUT /api/user/self Allows Quota Bypass

Redis user quota cache overwrite via PUT /api/user/self allows quota bypass Vulnerability Overview Vulnerability ID: GHSA-j6gc-4893-qwmp CVE ID: CVE-2024-44805 Severity: High Description: An authenticated user can repeatedly call using language or sidebar_modules while relaying requests are consuming quota. The setter path reads the full user snapshot and writes it back via , which refreshes the Redis in memory and overwrites the Quota field. This can result in the erasure of HNCRCBY quota deductions and artificially maintaining a high balance, allowing the caller to exceed the paid quota. Impact Scope Affected Versions: = v1.0.0-rc.16 Affected Components: - language/sidebar_modules branch - full snapshot update - full hash write - reads Redis cache Remediation Patch: This issue has been fixed in v1.0.0-rc.16. The fix scopes user setting updates to prevent outdated user snapshots from overwriting accounting fields, and allows the general user cache to be refreshed from quota cache updates that modify the Quota. Quota cache updates are reserved for atomic quota delta paths or explicit quota sync paths. Temporary Mitigations: If an immediate upgrade is not possible, operators should temporarily limit or throttle the frequency of calls and avoid frequent updates to user settings when Redis-backed quota caching is enabled. This is only a mitigation measure; an upgrade is recommended. Remediation Steps: Upgrade to v1.0.0-rc.16 or later. Deployments with Redis enabled should restart application instances after the upgrade to remove outdated process code paths. Additional Information Reporter: lhuil2208 Weakness: CWE-362

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-44805: Redis Quota Cache Overwrite via PUT /api/user/self Allows Quota Bypass

More from this source