CVE-2025-67733

Executive Summary

CVE-2025-67733 is a critical injection vulnerability in Valkey, a distributed key-value database. A malicious authenticated user can exploit improper null character handling in Lua scripting error handling to inject arbitrary data into the response stream of other clients sharing the same connection. This can lead to data corruption, tampering, or information disclosure. The vulnerability affects all versions prior to 9.0.2, 8.1.6, 8.0.7, and 7.2.12. While the EPSS score is currently 0.0%, the high CVSS score (8.5) and the potential for data integrity compromise make this a high-priority issue for any Valkey deployment.

Supply Chain & Package Security

Valkey is a community-driven fork of Redis, distributed as a standalone server. It is not typically distributed via package managers like NPM, PyPI, Go, or Ruby. However, it is often deployed as a container image (e.g., Docker Hub) or built from source. Organizations should verify the integrity of their Valkey binaries and ensure they are sourced from official repositories. The vulnerability is in the core server code, not in any client library, so the supply chain risk is primarily in the server binary itself.

CVSS Breakdown & Threat Level

CVSS Score: 8.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network (N) – The attack can be carried out remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): Low (L) – The attacker needs a valid, authenticated connection to Valkey, but no special administrative privileges.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – An attacker can read arbitrary data from the response stream.
• Integrity (I): High (H) – An attacker can inject or modify data in the response stream.
• Availability (A): High (H) – An attacker can corrupt the response stream, potentially causing denial of service for other clients.

Threat Level: High. The vulnerability allows for data injection and corruption with low complexity and low privileges. While it requires an authenticated connection, the potential impact on data integrity and confidentiality is severe.

Deep Dive & Mechanics

The vulnerability resides in the Lua scripting engine within Valkey. When a Lua script encounters an error, the error handling code constructs a response to send back to the client. This code does not properly sanitize or escape null characters (\0) that may be present in the error message or script output.

A malicious user can craft a Lua script that, when executed, produces an error message containing null bytes. Due to the improper handling, these null bytes can terminate the response string prematurely or inject arbitrary data into the response stream. This injected data can then be interpreted by other clients sharing the same connection (e.g., in a connection pool or multiplexed scenario) as part of their own response, leading to data corruption or information disclosure.

The core issue is a classic injection vulnerability (CWE-74) where untrusted data is not properly neutralized before being included in an output stream. In this case, the output stream is the network response to the client.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In the Lua error handling path
void handle_lua_error(lua_State *L, client *c) {
    const char *err = lua_tostring(L, -1);
    // Directly appending error to response without null-check
    addReplyError(c, err); // Vulnerable: err may contain null bytes
}

Patched Code (Conceptual):

void handle_lua_error(lua_State *L, client *c) {
    const char *err = lua_tostring(L, -1);
    // Sanitize the error string by replacing or escaping null bytes
    char *sanitized_err = sanitize_null_bytes(err);
    addReplyError(c, sanitized_err);
    free(sanitized_err);
}

The patch introduces a sanitization step that either removes, replaces, or escapes null bytes in the error string before it is appended to the response. This prevents the injection of arbitrary data into the response stream.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Valkey server running a vulnerable version (e.g., 7.2.11).
• A valid authenticated connection to the server.

Exploitation Steps:

1. Connect to the Valkey server:

   redis-cli -h target -p 6379
   

2. Authenticate (if required):

   AUTH yourpassword
   

3. Execute a malicious Lua script that triggers the vulnerability:

   -- This script attempts to inject a null byte into the error response
   local evil = "INJECTED_DATA\0"
   error(evil)
   

   In redis-cli, this can be done using the EVAL command:

   EVAL "local evil = 'INJECTED_DATA\0'; error(evil)" 0
   

4. Observe the response: The response may contain the injected data, potentially corrupting the protocol stream for other clients on the same connection.

Note: No public exploit code is available at this time. The above is a conceptual demonstration.

Blue Team (Detection & Hardening)

Detection:

• Monitor for Lua script errors that contain unusual characters, especially null bytes.
• Look for anomalous response patterns in Valkey logs, such as truncated or malformed responses.
• Use network monitoring to detect unexpected data in Valkey response streams.

Hardening:

• Immediately upgrade to a patched version (9.0.2, 8.1.6, 8.0.7, or 7.2.12).
• Restrict access to Valkey using firewall rules (e.g., allow only trusted IPs).
• Use TLS encryption for all Valkey connections to prevent man-in-the-middle attacks.
• Implement connection pooling with strict isolation to prevent cross-client contamination.
• Disable Lua scripting if not required (using the rename-command configuration directive).

Indicators of Compromise (IOCs)

• Network Traffic: Unusual or malformed RESP (REdis Serialization Protocol) responses containing null bytes or unexpected data.
• Logs: Valkey log entries showing Lua script errors with non-printable characters.
• Process: Abnormal memory usage or crashes in the Valkey server process.
• File System: No specific file system IOCs are expected, as the attack is in-memory.

Example Log Entry (Suspicious):

[error] Error running script (call to f_<hash>): @user_script:1: INJECTED_DATA<0x00>

Detection Engineering

YARA Rule

rule CVE_2025_67733_Valkey_Lua_Injection {
    meta:
        description = "Detects potential exploitation of CVE-2025-67733 in Valkey logs or network traffic"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67733"
    strings:
        $lua_error = /error\(.*\\x00.*\)/ nocase
        $null_byte = { 00 }
        $resp_error = /-\w+ Error running script/
    condition:
        ($lua_error or ($resp_error and #null_byte > 0))
}

Sigma Rule

title: CVE-2025-67733 Valkey Lua Script Null Byte Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Valkey log entries indicating a Lua script error containing null bytes, potential exploitation of CVE-2025-67733.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-67733
logsource:
    product: valkey
    service: server
detection:
    selection:
        - EventID: 0x00000001  # Example Valkey error event ID
        - Message|contains: "Error running script"
        - Message|contains: "\x00"
    condition: selection
falsepositives:
    - Legitimate use of null bytes in Lua scripts (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 6379 (msg:"CVE-2025-67733 Valkey Lua Script Null Byte Injection"; flow:to_server,established; content:"EVAL"; nocase; content:"error"; nocase; distance:0; within:100; content:"|00|"; within:50; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Valkey: Upgrade to version 9.0.2, 8.1.6, 8.0.7, or 7.2.12 (or later) immediately.
2. Restrict Network Access: Use firewall rules to limit access to Valkey to only trusted hosts.
3. Enable Authentication: Ensure Valkey is configured with a strong password (requirepass).

Long-Term Mitigations:

• Disable Lua Scripting: If not required, disable the EVAL and EVALSHA commands using rename-command EVAL "" and rename-command EVALSHA "" in valkey.conf.
• Monitor Logs: Implement centralized logging and monitoring for Valkey error messages.
• Use TLS: Encrypt all Valkey traffic using TLS to prevent network-level injection.
• Regular Audits: Conduct regular security audits of Valkey configurations and deployments.

Patch Details: The fix is included in the following releases:

• Valkey 9.0.2
• Valkey 8.1.6
• Valkey 8.0.7
• Valkey 7.2.12

These releases are available from the official Valkey GitHub repository: https://github.com/valkey-io/valkey/releases

Valters IT