## https://sploitus.com/exploit?id=905D3433-AEB3-5F4F-9CC4-918118074E96
# CVE-2021-32675 – Redis Pre-Allocation Denial of Service (OOM)
This repository contains a functional exploit for CVE-2021-32675, a denial-of-service (DoS) vulnerability in Redis. The flaw allows unauthenticated remote attackers to trigger massive memory pre-allocations on the Redis server by sending oversized bulk string headers without providing argument data, leading to memory exhaustion and service crash.
## Description
CVE-2021-32675 is a vulnerability in Redis query buffer handling. When parsing incoming commands in the RESP (REdis Serialization Protocol) protocol, Redis reads the declared length of a bulk string argument (`$\r\n`) and immediately pre-allocates an SDS (Simple Dynamic String) buffer in memory to receive the payload before reading any argument bytes.
Because this pre-allocation occurs before receiving the argument payload, an unauthenticated client can declare the maximum permitted bulk string size (by default, `proto-max-bulk-len` is 512 MB) and hold the connection open indefinitely without transmitting the actual data. Redis retains the pre-allocated memory for each active connection, creating an amplification ratio of approximately **32,000,000×** (~16 bytes of network traffic results in a 512 MB memory reservation).
Opening multiple concurrent connections using this header-only technique quickly exhausts available server memory, causing:
- Forced key evictions if a `maxmemory` policy is active.
- Denial of service by rejecting subsequent write operations (`OOM command not allowed`).
- Process termination by the operating system OOM (Out-Of-Memory) killer.
The vulnerability affects Redis versions prior to:
- 6.2.6
- 6.0.16
- 7.0 (when unauthenticated or running with default bulk limits)
Redis instances running without authentication (`requirepass` not configured) or with default `proto-max-bulk-len` (512 MB) are vulnerable to this exploit. Patched versions enforce a strict 16 KB protocol buffer limit for unauthenticated clients before pre-allocation takes place.
## Installation Instructions
1. Create a Virtual Environment (Optional but Recommended):
```bash
python3 -m venv .venv
source .venv/bin/activate
```
2. Install Dependencies:
```bash
pip install -r requirements.txt
```
## Requirements
- Python 3.8+
- colorama library
- redis library
- Vulnerable Redis instance (versions prior to 6.2.6 / 6.0.16 or unauthenticated instances)
## Usage
```bash
python3 exploit.py --host --port [options]
```
### Options
| Option | Type | Default | Description |
|---|---|---|---|
| `--host` | str | *Required* | Target Redis hostname or IP address |
| `--port` | int | `6379` | Port number |
| `--connections` | int | `10` | Number of malicious connections to open |
| `--size` | int | `512` | Declared bulk string buffer size in MB |
| `--hold` | int | `5` | Seconds to hold connections open before cleanup |
| `--password`, `--auth` | str | `None` | Password for Redis authentication (if needed) |
### Example
```bash
python3 exploit.py --host 127.0.0.1 --port 6379 --connections 10 --size 512 --hold 5
```
## Local Testing Environment (Optional)
You can launch a local test lab using the included Docker Compose configuration:
```bash
# Start vulnerable Redis (port 6380) and mitigated Redis (port 6381)
docker compose -f conf/docker-compose.yml up -d
# Test against the vulnerable instance
python3 exploit.py --host 127.0.0.1 --port 6380 --connections 10 --size 512
# Test against the mitigated instance
python3 exploit.py --host 127.0.0.1 --port 6381 --password "L4bS3cur3!2024" --connections 10 --size 512
# Stop the containers
docker compose -f conf/docker-compose.yml down
```
## Disclaimer
This Proof of Concept is provided for educational, research, and security verification purposes only. The author is not responsible for any misuse, damage, or unauthorized testing against systems without explicit permission.