CVE-2022-24834
HIGHRedis 2.6.0-6.0.19 - Authenticated Heap-based Buffer Overflow via Lua Script Execution
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2022-24834. PoCs published by convisolabs, DukeSec97.
AI-analyzed exploit summary This repository contains an improved exploit for CVE-2022-24834, a heap overflow vulnerability in the Lua interpreter included with Redis. The exploit leverages a heap overflow in the cjson library to achieve arbitrary memory read/write, leading to remote code execution (RCE).
Description
Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.
Exploits (2)
This repository contains an improved exploit for CVE-2022-24834, a heap overflow vulnerability in the Lua interpreter included with Redis. The exploit leverages a heap overflow in the cjson library to achieve arbitrary memory read/write, leading to remote code execution (RCE).
This PoC exploits CVE-2022-24834, a Lua sandbox escape in Redis, to achieve remote code execution (RCE) by sending a malicious Lua script that triggers a reverse shell. The exploit uses Redis' EVAL command to execute arbitrary commands on the target system.
References (4)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H