Redis sandbox escape (CVE-2022-0543)
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Redis is an open-source, in-memory data store that can be used as a database, cache, or message broker. A vulnerability (CVE-2022-0543) was discovered that allows an unauthenticated, remote attacker to execute arbitrary code on the vulnerable Redis infrastructure by loading a vulnerable Lua library.
Strategy
The detection looks for the opening of the LibC library which is called when the vulnerable Lua library calls io.popen to run arbitrary commands.
Triage & Response
- Determine whether the operating system of the resource is Debian or Ubuntu and Redis version < 5.0.14.
- Attempt to contain the compromise (possibly by terminating the workload, depending on the stage of attack). Follow your organization’s internal processes for investigating and remediating compromised systems.
- If the resource is running a vulnerable Redis version, update to a version that has been fixed.
Requires Agent Version 7.27 or greater.
