CVE-2022-0543 Scanner

Redis is a high-performance, in-memory key-value store widely used for caching, session management, real-time analytics, and message brokering. It is deployed by enterprises and developers to achieve low-latency data access and high throughput. Redis supports advanced data structures like lists, sets, and sorted sets, making it versatile for various applications.

CVE-2022-0543 is a critical vulnerability specific to Debian and Debian-based distributions of Redis. It arises from a packaging flaw where the Lua sandbox, intended to restrict script execution, is improperly configured. This allows an attacker to break out of the sandbox and execute arbitrary code on the host system.

The vulnerability is triggered through the EVAL or EVALSHA commands, which execute Lua scripts. Due to a missing package dependency, the Lua environment includes functions that can be abused to call system commands. Specifically, the 'lua-open' module is inadvertently exposed, enabling functions like 'os.execute' to run.

Exploitation of CVE-2022-0543 can lead to full remote code execution with the privileges of the Redis process. An attacker can compromise the entire system, steal sensitive data, install malware, or disrupt services. Given the CVSS score of 10.0, this vulnerability poses a severe risk to affected deployments.