# Source: https://docs.datadoghq.com/security/default_rules/def-000-8w8.md

---
title: Redis sandbox escape (CVE-2022-0543)
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Redis sandbox escape (CVE-2022-0543)
---

# Redis sandbox escape (CVE-2022-0543)
Classification:attackTactic:[TA0002-execution](https://attack.mitre.org/tactics/TA0002)Technique:[T1190-exploit-public-facing-application](https://attack.mitre.org/techniques/T1190) 
## What happened{% #what-happened %}

`{{ @process.comm }}` loaded the vulnerable LibC library `{{ @file.path }}`, indicating exploitation of the command code vulnerability `CVE-2022-0543`.

## Goal{% #goal %}

Redis is an open-source, in-memory data store that can be used as a database, cache, or message broker. A vulnerability (CVE-2022-0543) was discovered that allows an unauthenticated, remote attacker to execute arbitrary code on the vulnerable Redis infrastructure by loading a vulnerable Lua library.

## Strategy{% #strategy %}

The detection looks for the opening of the LibC library which is called when the vulnerable Lua library calls `io.popen` to run arbitrary commands.

## Triage & Response{% #triage--response %}

1. Determine whether the operating system of the resource is Debian or Ubuntu and Redis version < 5.0.14.
1. Attempt to contain the compromise (possibly by terminating the workload, depending on the stage of attack). Follow your organization's internal processes for investigating and remediating compromised systems.
1. If the resource is running a vulnerable Redis version, update to a version that has been fixed.

*Requires Agent Version 7.27 or greater.*