Critical Redis Vulnerability Patched: A 13-Year-Old Bug Allowed Remote Code Execution
A significant, long-standing security flaw has been discovered and patched in Redis, the popular in-memory data structure store. The vulnerability, which existed for over a decade, could allow attackers to achieve remote code execution (RCE) on affected servers, potentially leading to a complete system compromise.
This critical issue highlights the importance of timely updates and proactive security measures for all Redis administrators. If you are running a vulnerable version, immediate action is required to protect your infrastructure.
Understanding the Lua Scripting Vulnerability
The security flaw does not reside in the core Redis code itself but in a third-party Lua library it utilizes. Specifically, the vulnerability is triggered within the cjson/cmsgpack libraries used by the Redis Lua scripting engine. This engine allows users to run complex, server-side scripts using the EVAL command, a powerful feature for custom data manipulation.
An attacker could exploit this flaw by crafting a malicious Lua script. When this script is executed on a vulnerable Redis server, it can cause an integer overflow that leads to a heap overflow. This memory corruption can then be leveraged to execute arbitrary code on the underlying server, giving the attacker control.
For an attack to be successful, the threat actor needs the ability to execute Lua scripts on the Redis instance. While this requires a certain level of access, many misconfigured or internally accessible servers could be at risk.
Which Redis Versions Are Affected?
The vulnerability impacts a wide range of Redis versions, spanning many years of releases. You should consider your systems vulnerable if you are running:
- Redis versions 2.6 through 7.2.4
This extensive range means that a vast number of production environments are likely exposed if they have not been recently updated. The flaw was introduced when the Lua scripting feature was first added, which explains its 13-year lifespan before discovery.
How to Protect Your Redis Instances: Immediate Steps
The Redis maintainers have released patches to address this critical vulnerability. The primary and most effective way to secure your systems is to upgrade immediately.
1. Upgrade to a Patched Version
The vulnerability has been fixed in the latest release. Administrators are strongly urged to upgrade to Redis version 7.2.5 or newer. This version contains the patched Lua libraries that prevent the heap overflow condition.
2. Implement Security Best Practices
Beyond patching, this vulnerability serves as a critical reminder to follow established security best practices for any Redis deployment. These steps provide defense-in-depth and can mitigate the risk of this and future vulnerabilities:
Restrict Network Access: Never expose a Redis instance directly to the public internet. Redis is designed to be a fast, trusted backend service. It should only be accessible from trusted application servers within a secured network or VPC. Use firewalls to block all external access to your Redis port.
Enforce Strong Authentication: Always configure Redis with a strong password using the
requirepassdirective. For more granular control, use the Access Control List (ACL) feature available in modern Redis versions to create users with specific permissions.Limit Command Execution: Use Redis ACLs to restrict which users can execute potentially dangerous commands like
EVAL,EVALSHA, andSCRIPT. By limiting access to the Lua scripting engine, you can prevent unauthorized users from attempting to trigger this vulnerability.Rename Dangerous Commands: As an additional layer of security, you can rename critical commands to obscure them from attackers. For example, renaming the
EVALcommand to a long, random string makes it much harder for an automated exploit to succeed.
By combining an immediate upgrade with these robust security measures, you can ensure your Redis data stores remain secure, performant, and reliable. Don’t delay—review your Redis versions and security configurations today.
Source: https://securityaffairs.com/183097/security/redis-patches-13-year-old-lua-flaw-enabling-remote-code-execution.html
