Redis Unauthenticated RCE & Lua Sandbox Escapes (CVE-2022-0543 & Rogue Replication)

1. The Perils of Exposing Port 6379

Redis is the world's most popular in-memory data store, heavily utilized in ecommerce architectures (Magento, Shopify custom apps, WooCommerce) for fast session storage, Full-Page Cache (FPC) tags, and Redis Queue job management. Designed from inception to operate exclusively inside trusted private networks, exposing Redis instances to the public internet has historically resulted in automated worm infections and cryptocurrency miners.

In 2022, CVE-2022-0543 (CVSS 10.0) revealed that Redis instances installed on Debian and Ubuntu distributions could be completely compromised for remote code execution via a flaw in how the Lua scripting engine was packaged.

2. CVE Metadata Overview

3. Technical Root Cause: The Uncleaned Lua Package Table

Redis embeds a Lua interpreter to execute atomic server-side scripts via the EVAL command. To prevent malicious scripts from interacting with the host operating system, Redis initializes the Lua environment in a strict sandbox, removing standard libraries like os and io.

However, the Debian packaging maintainers compiled the Lua library as a dynamic shared library (liblua5.1.so). During initialization, the Debian package initialization script loaded an auxiliary module that populated the global package table. The Redis sandbox initialization code failed to clear this table.

An attacker connected to Redis could invoke package.loadlib to dynamically load the standard C library (libc.so.6) into the Redis process address space and execute arbitrary shell commands directly via system():

EVAL "local io_l = package.loadlib('/lib/x86_64-linux-gnu/libc.so.6', 'system'); io_l('id > /tmp/pwned.txt');" 0

4. Hardening Blueprint for Production Redis Instances

1. Bind Strictly to Localhost or Unix Socket:

   
   # In /etc/redis/redis.conf
   bind 127.0.0.1 ::1
   protected-mode yes
   

2. Enforce Mandatory Password Authentication:

   
   requirepass "A_Complex_High_Entropy_64_Char_Password"
   

3. Rename Dangerous Administrative Commands:

   
   rename-command FLUSHALL ""
   rename-command FLUSHDB ""
   rename-command CONFIG ""
   rename-command EVAL ""
   rename-command MODULE ""