Goal

Redis is an open-source, in-memory data store that can be used as a database, cache, or message broker. A vulnerability (CVE-2022-0543) was discovered that allows an unauthenticated, remote attacker to execute arbitrary code on the vulnerable Redis infrastructure by loading a vulnerable Lua library.

Strategy

The detection looks for the opening of the LibC library which is called when the vulnerable Lua library calls io.popen to run arbitrary commands.

Triage & Response

1. Determine whether the operating system of the resource is Debian or Ubuntu and Redis version < 5.0.14.
2. Attempt to contain the compromise (possibly by terminating the workload, depending on the stage of attack). Follow your organization’s internal processes for investigating and remediating compromised systems.
3. If the resource is running a vulnerable Redis version, update to a version that has been fixed.

Requires Agent Version 7.27 or greater.