Yudai Fujiwara

The web management console allows an authenticated user to perform OS command injection, which can lead to arbitrary command execution with root privileges. OS command injection is a flaw where an application passes unsafe user-supplied data to a system shell, allowing the execution of unauthorized operating system commands.

A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, resulting in heap corruption and potentially remote code execution. The issue affects only authenticated and authorized users.