Description
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Exploits (9)
metasploit
WORKING POC
EXCELLENT
by Reginaldo Silva, jbaines-r7 · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/redis/redis_debian_sandbox_escape.rb
Nuclei Templates (1)
Redis Sandbox Escape - Remote Code Execution
CRITICALby dwisiswant0
Shodan:
redis_version || redis
References (7)
Scores
CVSS v3
10.0
EPSS
0.9440
EPSS Percentile
100.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lab Environment
COMMUNITY
+355 more images
Community Lab
+5 more repos
Details
CISA KEV
2022-03-28
VulnCheck KEV
2022-03-24
InTheWild.io
2022-03-11
ENISA EUVD
EUVD-2022-15665
CWE
CWE-862
Status
published
Products (1)
redis/redis
Published
Feb 18, 2022
KEV Added
Mar 28, 2022
Tracked Since
Feb 18, 2026