CVE-2026-78378

{"id": "CVE-2026-78378", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78378", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T15:20:38.814691Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "affectedData": [{"repo": "https://github.com/RansomLook/RansomLook", "vendor": "ransomlook", "product": "ransomlook", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-24T14:17:05.533", "references": [{"url": "https://github.com/RansomLook/RansomLook/commit/1f14c01b6fdf8d534edfb2790cf76f5bac6e73f8.", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns.\n\n\nThe /api/health/<name> endpoint attempted to resolve the supplied name to a known group or market, but when resolution failed it fell back to using the attacker-controlled value directly in a Redis key pattern. An unauthenticated attacker could therefore supply Redis glob metacharacters such as *, ?, [ or ] to broaden the SCAN operation beyond the intended group. For example, requesting /api/health/* could enumerate health information, mirror slugs, and uptime series belonging to all groups and markets, including entities marked as private.\n\n\nSimilar unsafe interpolation was present in /api/crypto/chain/<chain> and in the delete_manual_torrent() function. The latter represents a potentially destructive sink because a crafted infohash containing glob metacharacters could cause the scan to match torrent-health keys belonging to other torrents if attacker-controlled input can reach that function.\n\n\nThe patch removes the unsafe fallback from the health endpoint and introduces glob escaping for user-controlled values before they are incorporated into Redis SCAN MATCH expressions."}, {"lang": "es", "value": "Ransomlook contiene una vulnerabilidad de inyecci\u00f3n de patr\u00f3n glob de Redis causada por la neutralizaci\u00f3n insuficiente de la entrada controlada por el usuario antes de que se incorpore en los patrones Redis SCAN MATCH.\n\nEl endpoint /api/health/<name> intent\u00f3 resolver el nombre proporcionado a un grupo o mercado conocido, pero cuyo la resoluci\u00f3n fall\u00f3, recurri\u00f3 a usar el valor controlado por el atacante directamente en un patr\u00f3n de clave de Redis. Un atacante no autenticado podr\u00eda, por lo tanto, proporcionar metacaracteres glob de Redis como '*', '?', '[' o ']' para ampliar la operaci\u00f3n SCAN m\u00e1s all\u00e1 del grupo previsto. Por ejemplo, solicitar /api/health/* podr\u00eda enumerar informaci\u00f3n de salud, 'mirror slugs' y series de tiempo de actividad pertenecientes a todos los grupos y mercados, incluidas las entidades marcadas como privadas.\n\nUna interpolaci\u00f3n insegura similar estaba presente en /api/crypto/chain/<chain> y en la funci\u00f3n delete_manual_torrent(). Esta \u00faltima representa un 'sink' potencialmente destructivo porque un 'infohash' manipulado que contenga metacaracteres glob podr\u00eda hacer que el escaneo coincida con claves de salud de torrents pertenecientes a otros torrents si la entrada controlada por el atacante puede llegar a esa funci\u00f3n.\n\nEl parche elimina el 'fallback' inseguro del endpoint de salud e introduce el escape de glob para los valores controlados por el usuario antes de que se incorporen en las expresiones Redis SCAN MATCH."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8"}