CVE-2022-24735 Lua scripts can be manipulated to overcome ACL rules in Redis

What is CVE-2022-24735?

CVE-2022-24735 is a low-severity code injection vulnerability in Fedoraproject Fedora, published on 27 Apr 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. The Lua script execution environment in Redis provides some measures that prevent a script from creating side effects that persist and can affect the execution of the same, or different script, at a later time. Several weaknesses of these measures have been publicly known for a long time, but they had no security impact as the Redis security model did not endorse the concept of users or privileges. With the introduction of ACLs in Redis 6.0, these weaknesses can be exploited by a less privileged users to inject Lua code that will execute at a later time, when a privileged user executes a Lua script. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.

Weakness: CWE-94

Which versions are affected by CVE-2022-24735?

3 open source packages ship an affected version, including keydb, redis and valkey. It affects 5 products.

Products include Fedoraproject Fedora, Netapp Management Services for Element Software, Netapp Management Services for Netapp Hci, Oracle Communications Operations Monitor, Redis Redis.

How do I fix CVE-2022-24735?

Upgrade keydb to 6.2.7 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-24735 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24735 exists.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2022-24735, AZL-45285, AZL-71173, AZL-9598, BIT-keydb-2022-24735, BIT-redis-2022-24735 and 4 more.