Redis sandbox escape (CVE-2022-0543)
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Redis is an open-source, in-memory data store that can be used as a database, cache, or message broker. A vulnerability (CVE-2022-0543) was discovered that allows an unauthenticated, remote attacker to execute arbitrary code on the vulnerable Redis infrastructure by loading a vulnerable Lua library.
Strategy
The detection looks for the opening of the LibC library which is called when the vulnerable Lua library calls io.popen to run arbitrary commands.
Triage & Response
- Determine whether the operating system of the resource is Debian or Ubuntu and Redis version < 5.0.14.
- Attempt to contain the compromise (possibly by terminating the workload, depending on the stage of attack). Follow your organization’s internal processes for investigating and remediating compromised systems.
- If the resource is running a vulnerable Redis version, update to a version that has been fixed.
Requires Agent Version 7.27 or greater.
