Redis Remote Code Execution Vulnerability via Lua Scripting

A remote code execution vulnerability has been identified in Redis versions prior to 6.2.17, 7.2.7, and 7.4.2. This issue allows an authenticated user to execute a specially crafted Lua script that manipulates the garbage collector, potentially leading to arbitrary code execution. The vulnerability exists in all versions of Redis that support Lua scripting.

Impact

Exploitation of this vulnerability could result in unauthorized remote code execution on the server where Redis is running.

Remediation

Users can upgrade to Redis versions 6.2.17, 7.2.7, or 7.4.2 to address this vulnerability. For those using Redis 5.0, an additional step can be taken to disable the EVAL and EVALSHA commands using the Redis Access Control List (ACL) feature, which prevents users from executing Lua scripts.