CVE-2022-0543
Debian-specific Redis Server Lua Sandbox Escape Vulnerability
Description
CVE-2022-0543 is a Lua sandbox escape vulnerability in Redis as packaged by Debian and Debian-derived Linux distributions that allows remote attackers to execute arbitrary code on the Redis server. The vulnerability stems from the Debian-specific packaging of Redis which inadvertently exposed Lua's package module, breaking the sandbox intended to restrict script execution. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 97.3% (99.9th percentile), this vulnerability is extensively exploited by malware and botnet operators.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| redis | redis | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html(Exploit, Third Party Advisory, VDB Entry)
- https://bugs.debian.org/1005787(Issue Tracking, Patch, Third Party Advisory)
- https://lists.debian.org/debian-security-announce/2022/msg00048.html(Mailing List, Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20220331-0004/(Third Party Advisory)
- https://www.debian.org/security/2022/dsa-5081(Mailing List, Third Party Advisory)
- https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0543(US Government Resource)
Weakness Type
CWE-265: Privilege Issues
This weakness involves improper handling of privileges that can lead to unauthorized access or code execution. In CVE-2022-0543, the Debian packaging of Redis failed to properly maintain the Lua sandbox restrictions, allowing scripts to escape the sandbox and execute arbitrary system commands. For more details, see CWE-265.
Impact Analysis
Successful exploitation allows attackers to execute arbitrary operating system commands on the Redis server with the privileges of the Redis process. Since Redis is commonly used as a cache, message broker, or database in web application architectures, compromise of the Redis server can expose cached credentials, session tokens, and sensitive application data. Attackers frequently use compromised Redis instances to pivot to other systems in the application infrastructure, deploy cryptocurrency miners, or establish persistent backdoor access. The vulnerability is particularly impactful in cloud environments where Redis is used as a shared service across multiple applications.
Exploit Maturity
CVE-2022-0543 was added to CISA's KEV catalog on March 28, 2022, confirming active exploitation. The EPSS score of 97.3% (99.9th percentile) reflects extremely widespread exploitation. Within days of disclosure, the Muhstik botnet and other malware campaigns began actively exploiting this vulnerability to compromise Redis servers for cryptocurrency mining and DDoS attacks. Public exploit code is readily available and the exploitation is straightforward, requiring only the ability to send commands to the Redis server.
Remediation
- Update the Redis package on Debian-based systems (Debian, Ubuntu, etc.) to the patched version provided by the distribution, as required by CISA's KEV catalog.
- Restrict network access to Redis by binding it to localhost or trusted interfaces only, and implement firewall rules to block unauthorized access.
- Enable Redis authentication using the requirepass configuration directive to prevent unauthorized command execution.
- Disable or restrict the EVAL and EVALSHA commands if Lua scripting is not required for your application.
- Monitor Redis logs and system activity for signs of exploitation, including unexpected Lua script execution, new outbound connections, and unusual CPU usage patterns.
Technical Details
The vulnerability is specific to how Debian packages Redis, not to upstream Redis itself. When building the Redis package, Debian's build process links Redis against the system Lua library rather than the bundled version. This packaging choice inadvertently exposes the Lua package module within the Redis Lua sandbox. In standard Redis, the Lua sandbox removes access to dangerous modules like package and os. However, the Debian build left the package.loadlib function accessible, which allows loading arbitrary shared libraries. An attacker can use the loadlib function to load liblua5.1.so, access the os.execute function, and execute arbitrary shell commands on the server. The exploit requires only the ability to send EVAL commands to the Redis server.
Frequently Asked Questions
What is CVE-2022-0543?
CVE-2022-0543 is a Lua sandbox escape vulnerability specific to Debian-packaged Redis. It allows attackers to break out of the Lua scripting sandbox and execute arbitrary operating system commands on the Redis server.
Which Redis installations are affected?
Only Redis installations on Debian and Debian-derived distributions (Ubuntu, Linux Mint, etc.) that use the distribution-packaged version of Redis are affected. Redis installed from source, from the official Redis repositories, or running on non-Debian distributions is not affected.
Does this affect Redis running in Docker?
It depends on the Docker image. Official Redis Docker images are based on Debian but typically build Redis from source, which is not affected. However, Docker images that install Redis from the Debian package repository could be vulnerable.
Can this be exploited remotely?
Yes, if the Redis server is accessible over the network. Redis is frequently exposed without authentication, making it directly exploitable by any attacker who can reach the network port. Even with authentication, any authenticated user can exploit this vulnerability through EVAL commands.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.