Exploitation Summary
CVE-2022-0543 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 28, 2022.
EIP tracks 9 public exploits from researchers including 0x7eTeam, z92g, JacobEbben, including a Metasploit module exploits/linux/redis/redis_debian_sandbox_escape.
A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits CVE-2022-0543, a Redis Lua sandbox bypass vulnerability, to achieve remote command execution by loading the Lua 'io' library and executing arbitrary commands via `io.popen`.
Description
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Exploits (9)
This PoC exploits CVE-2022-0543, a Redis Lua sandbox bypass vulnerability, to achieve remote command execution by loading the Lua 'io' library and executing arbitrary commands via `io.popen`.
This is a functional exploit for CVE-2022-0543, a Redis sandbox escape vulnerability. It leverages Lua script execution to achieve remote command execution (RCE) on vulnerable Redis instances.
This is a functional exploit for CVE-2022-0543, a Lua sandbox escape vulnerability in Redis. It allows remote command execution via crafted Lua scripts, with options for reverse shells, single commands, or an interactive shell.
This repository contains a Python script that checks for Redis unauthenticated access and exploits CVE-2022-0543, a Lua sandbox escape vulnerability, to achieve remote command execution (RCE).
This repository provides a Docker-based lab environment to demonstrate CVE-2022-0543, a Redis Lua sandbox escape vulnerability specific to Debian/Ubuntu packages. It includes a vulnerable Redis instance and references an external PoC for exploitation.
This repository contains a functional exploit for CVE-2022-0543, a Lua sandbox escape vulnerability in Redis. The exploit leverages Lua's package.loadlib to escape the sandbox and execute arbitrary commands, including reverse shells.
This repository contains a functional exploit for CVE-2022-0543, a Lua sandbox escape vulnerability in Redis. The exploit leverages the Lua sandbox escape to execute arbitrary commands, including reverse shells and single command execution.
This repository is part of the Vulhub project, which provides pre-built Docker environments for vulnerability testing and research. It includes documentation and Docker configurations for various CVEs, including CVE-2022-0543, but does not contain direct exploit code.
This Metasploit module exploits CVE-2022-0543, a Lua sandbox escape in Debian/Ubuntu Redis packages, allowing arbitrary command execution via the `package.loadlib` function. It supports both direct command execution and staged payloads, targeting x86_64 systems.
Nuclei Templates (1)
redis_version || redis
References (7)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H