Redis sandbox escape (CVE-2022-0543)

Docs > Datadog Security > OOTB Rules > Redis sandbox escape (CVE-2022-0543)

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1190-exploit-public-facing-application

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Redis is an open-source, in-memory data store that can be used as a database, cache, or message broker. A vulnerability (CVE-2022-0543) was discovered that allows an unauthenticated, remote attacker to execute arbitrary code on the vulnerable Redis infrastructure by loading a vulnerable Lua library.

Strategy

The detection looks for the opening of the LibC library which is called when the vulnerable Lua library calls io.popen to run arbitrary commands.

Triage & Response

Determine whether the operating system of the resource is Debian or Ubuntu and Redis version < 5.0.14.
Attempt to contain the compromise (possibly by terminating the workload, depending on the stage of attack). Follow your organization’s internal processes for investigating and remediating compromised systems.
If the resource is running a vulnerable Redis version, update to a version that has been fixed.

Requires Agent Version 7.27 or greater.