CVE-2026-78378: Redis Glob Pattern Injection Allows Unauthorized Enumeration of Private Ransomlook Data
Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns.
The /api/health/<name> endpoint attempted to resolve the supplied name to a known group or market, but when resolution failed it fell back to using the attacker-controlled value directly in a Redis key pattern. An unauthenticated attacker could therefore supply Redis glob metacharacters such as , ?, [ or ] to broaden the SCAN operation beyond the intended group. For example, requesting /api/health/ could enumerate health information, mirror slugs, and uptime series belonging to all groups and markets, including entities marked as private.
Similar unsafe interpolation was present in /api/crypto/chain/<chain> and in the deletemanualtorrent() function. The latter represents a potentially destructive sink because a crafted infohash containing glob metacharacters could cause the scan to match torrent-health keys belonging to other torrents if attacker-controlled input can reach that function.
The patch removes the unsafe fallback from the health endpoint and introduces glob escaping for user-controlled values before they are incorporated into Redis SCAN MATCH expressions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the /api/health/<name> endpoint does not fall back to using attacker-controlled input directly in a Redis key pattern when group/market resolution fails, and escape user-controlled values to neutralize glob metacharacters (*, ?, [, ]) before incorporating them into Redis SCAN MATCH expressions.
Ransomlook /api/health/<name> Redis SCAN MATCH pattern construction (fallback + glob escaping) = Remove attacker-controlled fallback; escape glob metacharacters before using in SCAN MATCH - Configuration
Update /api/crypto/chain/<chain> to apply the same glob escaping/neutralization so that user-controlled values containing glob metacharacters are not interpolated unsafely into Redis SCAN MATCH patterns.
Ransomlook /api/crypto/chain/<chain> Redis SCAN MATCH pattern construction = Glob metacharacters must be escaped before use in Redis SCAN MATCH - Configuration
Update delete_manual_torrent() to escape glob metacharacters in any user-influenced value before incorporating it into Redis SCAN MATCH expressions to prevent cross-tenant/torrent key matching.
Ransomlook delete_manual_torrent() User-controlled value incorporation into Redis SCAN MATCH pattern = Glob escaping/neutralization before use
Event History
Frequently Asked Questions
Who can exploit the data-enumeration issue?
The affected health endpoint can be exploited without authentication. An attacker can submit Redis glob metacharacters in the name path parameter after normal group or market resolution fails.
What information may be exposed?
A broadened Redis SCAN MATCH operation can enumerate health information, mirror slugs, and uptime series for groups and markets. This includes entities marked as private.
Are other code paths affected besides the health endpoint?
Similar unsafe interpolation was present in the crypto chain endpoint and in delete_manual_torrent(). The delete_manual_torrent() path may be destructive if attacker-controlled infohash input reaches it, because a crafted glob can match torrent-health keys for other torrents.
What change addresses the issue?
The patch removes the health endpoint's unsafe fallback that used an unresolved name directly in a Redis key pattern. It also adds glob escaping for user-controlled input.