Redis LUA Scripting Vulnerability Allowing Code Execution in Another User's Context

A vulnerability in Redis versions through 8.2.1 allows authenticated users to execute crafted Lua scripts that can manipulate Lua objects and potentially execute code in the context of other users. This issue affects all Redis versions that support Lua scripting.

Impact

Exploitation of this vulnerability allows for unauthorized code execution in the context of another user.

Reproduction

To reproduce this vulnerability, an authenticated user can execute a Lua script that manipulates Lua objects and uses deprecated functions like 'setfenv' or 'newproxy' to run code in the context of another user.

Remediation

Users can upgrade to Redis version 8.2.2, which addresses this vulnerability. Alternatively, Lua script execution can be disabled using Access Control Lists (ACLs) to restrict the EVAL and FUNCTION command families.