CVE-2022-24834: Redis Lua Script RCE Vulnerability

CVE-2022-24834 Overview

CVE-2022-24834 is a heap overflow vulnerability in Redis, an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, resulting in heap corruption and potentially remote code execution. The vulnerability exists in all versions of Redis with Lua scripting support, starting from version 2.6, and affects only authenticated and authorized users.

Critical Impact

Authenticated attackers can achieve remote code execution through heap corruption by exploiting the cjson library via malicious Lua scripts.

Affected Products

• Redis versions 2.6 through 6.0.19
• Redis versions 6.2.0 through 6.2.12
• Redis versions 7.0.0 through 7.0.11
• Fedora 37
• Fedora 38

Discovery Timeline

• July 13, 2023 - CVE-2022-24834 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-24834

Vulnerability Analysis

This vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). The flaw resides in the cjson library bundled with Redis, which is used for JSON parsing within Lua scripts. When processing specially crafted JSON data through Lua scripting functionality, the parser fails to properly validate input boundaries, leading to a heap overflow condition.

The vulnerability requires authentication, meaning an attacker must have valid credentials and authorization to execute Lua scripts on the Redis server. However, once authenticated, the attacker can craft malicious Lua code that exploits the cjson parsing vulnerability to corrupt heap memory. This heap corruption can be leveraged to achieve arbitrary code execution on the underlying system, potentially compromising the entire Redis deployment and any connected applications.

Root Cause

The root cause is improper memory bounds checking in the cjson library when handling JSON data within Lua scripts. The cjson library fails to adequately validate the size of input data before writing to heap-allocated buffers, allowing attackers to write beyond the allocated memory region and corrupt adjacent heap structures.

Attack Vector

The attack is network-based and requires low attack complexity once the attacker has obtained valid credentials. The exploitation path involves:

1. Authenticating to the Redis server with valid credentials
2. Crafting a malicious Lua script that invokes cjson parsing functions
3. Providing specially crafted JSON input designed to trigger the heap overflow
4. Achieving heap corruption that can be weaponized for code execution

Since Lua scripting in Redis is a powerful feature often used for complex operations, environments that expose this functionality to users with less-than-full trust are particularly at risk.

Detection Methods for CVE-2022-24834

Indicators of Compromise

• Unusual or malformed Lua script executions containing cjson function calls with abnormally large or malformed JSON payloads
• Redis server crashes or unexpected restarts potentially indicating exploitation attempts
• Memory corruption signatures in Redis process memory dumps
• Anomalous EVAL or EVALSHA commands with suspicious Lua code patterns

Detection Strategies

• Monitor Redis logs for unusual Lua script execution patterns, particularly those involving cjson.decode() or cjson.encode() functions
• Implement network-level monitoring for Redis protocol traffic containing potentially malicious Lua scripts
• Deploy memory-based detection rules to identify heap corruption patterns characteristic of this vulnerability
• Use application-level logging to track all Lua script executions and their sources

Monitoring Recommendations

• Enable Redis slow log and monitor for unusual script execution times that may indicate exploitation attempts
• Implement alerting on Redis server process crashes or abnormal terminations
• Monitor system-level indicators such as unexpected child processes spawned by the Redis server
• Track authentication patterns and alert on anomalous access to Lua scripting functionality

How to Mitigate CVE-2022-24834

Immediate Actions Required

• Upgrade Redis to patched versions: 7.0.12, 6.2.13, or 6.0.20 immediately
• Restrict access to Redis Lua scripting functionality to only trusted users and applications
• Review and audit all Lua scripts currently deployed to identify potentially malicious code
• Implement network segmentation to limit access to Redis instances from untrusted networks
• Enable Redis ACLs to restrict which users can execute Lua scripts

Patch Information

Redis has addressed this vulnerability in versions 7.0.12, 6.2.13, and 6.0.20. Organizations should upgrade to these versions or later to remediate the vulnerability. The fix addresses the heap overflow condition in the cjson library by implementing proper bounds checking during JSON parsing operations.

For additional details, refer to the GitHub Security Advisory. Fedora users should also apply updates as announced in the Fedora package announcements.

Workarounds

• Disable Lua scripting entirely if not required for operations by using rename-command EVAL "" and rename-command EVALSHA "" in Redis configuration
• Implement strict ACL rules to prevent untrusted users from executing Lua scripts using ACL SETUSER commands
• Use network-level controls (firewall rules, security groups) to restrict Redis access to only authorized clients
• Consider running Redis in protected mode and binding only to trusted network interfaces

# Configuration example - Disable Lua scripting commands
# Add to redis.conf to prevent exploitation if patching is not immediately possible
rename-command EVAL ""
rename-command EVALSHA ""
rename-command SCRIPT ""

# Alternatively, use ACLs to restrict Lua access (Redis 6.0+)
# Create a user without script permissions
ACL SETUSER limited_user on >password ~* &* +@all -@scripting