What is Redigo Malware? How to Protect Your Redis Server from Redigo Malware?

Aqua Nautilus revealed a new undetected threat targeting a critical vulnerability CVE-2022-0543 discovered in the Lua scripting engine in the Redis datastore. Since the malware is written in the go language and can be capable of riding the vulnerable Redis server, Aqua’s research team, Nautilus, named the malware Redigo. As per the report shared, Redigo enables adversaries to take over the vulnerable Redis server and change the role of the server to act as a client to the adversaries’ rogue Redis server. Once the attackers establish their control on the victim Redis server, they can abuse the compromised Redis server to join their bot network to carry out distributed denial of service attacks, steal sensitive information on the compromised server, or even use the victim’s resources in crypto mining activities. Considering all these implications, it is good to know what is Redigo malware and how to protect your Redis server from Redigo malware.

What Is Redis?

Redis is an open-source, in-memory data store used as a database, cache, and message broker. Redis is often referred to as a NoSQL or key-value store that serves up fast access to stored data structures. It supports various data types such as strings, hashes, lists, sets, and sorted sets with range queries, bitmaps, hyperlogs, and geospatial indexes.

Redis also provides high availability via its master-slave replication feature. It allows data fetching and delivery in a short response time, allowing millions of requests per second. Redis is highly scalable and can support up to 2000+ client connections per second. It is terrifically faster than a relational database. It is often used for gaming applications, real-time analytics, leaderboards, user profiles, and session management, web page rendering, caching, and more.

Redis is written in C and is designed to be very fast and efficient with memory as well as storage. It also supports cluster mode allowing for easy horizontal scaling. With its robust feature set and performance benefits, Redis has become a popular choice among developers looking for an effective data storage solution.

Summary Of CVE-2022-0543- A Critical Lua Sandbox Escape Vulnerability In Redis

Well, the CVE-2022-0543 vulnerability was disclosed in March 2022. To give you the background once again, The issue exists in the Lua scripting engine in the Redis datastore, the scripting engine developed by Lua programming language, which can be accessed through the eval command. As per the design, the Lua engine should be sandboxed so that Redis clients can only interact with the Redis APIs, and clients shouldn’t be able to execute arbitrary code on the Redis running machine.

This vulnerability is because the Lua library in some Debian/Ubuntu packages is provided as a dynamic library. When the Lua interpreter initializes, the “package” variable is automatically populated, and that in turn, permits access to arbitrary Lua functionality. This lets remote attackers with the ability to execute Lua scripts escape the Lua sandbox and execute arbitrary code on the host.

This is a Critical vulnerability scored 10 out of 10 in the CVSS score.

A Short Note About Redigo Malware:

This is a backdoor malware designed to target the Redis servers vulnerable to CVE-2022-0543. Redogp initially tries to scan the vulnerable Redis servers exposed to the internet on port 6379 and tries to connect and delivers the shared dynamic library exp_lin.so which helps the attackers to download the exploits, run the commands & arbitrary code, elevate the privileges, and finally steal the sensitive data, or complete takeover the Redis server. 

It is difficult to identify the malware as it operates on port 6379, which is the official Redis communication port on that Redis client-server communication happens. Once the attacker succeeds in delivering the Redigo malware, he can turn the compromised Redis server into a slave and create a command-and-control relationship between the attacker’s rough Redis server and the victim Redis server, which will become client post-compromise. 

This go language backdoor not just helps advisories to maintain persistence, but it also helps to join their bot network to carry out distributed denial of service attacks, steal sensitive information on the compromised server, or even use victims’ resources in crypto mining activities.