CVE-2022-4064 in Dalli
Summary
by MITRE • 11/20/2022
A vulnerability was found in Dalli. It has been classified as problematic. Affected is the function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The name of the patch is 48d594dae55934476fec61789e7a7c3700e0f50d. It is recommended to apply a patch to fix this issue. VDB-214026 is the identifier assigned to this vulnerability.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/28/2025
The vulnerability identified as CVE-2022-4064 represents a critical injection flaw within the Dalli caching library, a popular ruby client for Redis. This vulnerability specifically targets the meta protocol handler component, which is responsible for managing metadata operations within the caching infrastructure. The flaw exists in the self.meta_set function located within the lib/dalli/protocol/meta/request_formatter.rb file, making it a targeted attack surface for malicious actors seeking to manipulate caching operations. The vulnerability has been publicly disclosed and is actively being exploited, as indicated by the VDB-214026 identifier assigned to this issue, which places it within the realm of known exploited vulnerabilities requiring immediate attention.
The technical nature of this vulnerability stems from inadequate input validation and sanitization within the meta protocol handler's request formatting mechanism. When the self.meta_set function processes metadata requests, it fails to properly escape or validate user-supplied data before incorporating it into the caching operations. This creates an injection vector that allows attackers to manipulate the underlying Redis operations through crafted metadata inputs. The vulnerability maps directly to CWE-74, which describes "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", and aligns with ATT&CK technique T1190, "Exploit Public-Facing Application", as it affects a widely-used library that serves as a public interface to caching systems. The injection occurs at the protocol level where metadata operations are formatted for Redis communication, potentially allowing attackers to execute arbitrary commands or manipulate cached data.
The operational impact of this vulnerability extends beyond simple data manipulation, as it can compromise the integrity and availability of caching systems that rely on Dalli. Attackers exploiting this vulnerability could potentially inject malicious metadata that alters cache behavior, causes denial of service through malformed requests, or even escalate privileges within systems that depend on Redis for caching operations. The vulnerability affects systems where Dalli is used as a caching layer, particularly those implementing Redis-based caching solutions that handle sensitive data or user requests. Organizations running applications that utilize this library are at risk of cache poisoning attacks, where malicious metadata could be stored in cache and subsequently served to other users, creating a persistent threat vector. The public disclosure of the exploit and the availability of the patch reference 48d594dae55934476fec61789e7a7c3700e0f50d indicate that this vulnerability has been actively weaponized in the wild, making immediate remediation essential.
Mitigation strategies for CVE-2022-4064 should prioritize immediate patch application using the referenced commit 48d594dae55934476fec61789e7a7c3700e0f50d which contains the necessary code modifications to address the injection vulnerability. Organizations should also implement network segmentation and access controls to limit exposure of Redis instances to untrusted networks, as this vulnerability could be exploited through compromised applications using the Dalli library. Additional defensive measures include implementing strict input validation at application boundaries, monitoring for anomalous metadata patterns in cache operations, and conducting regular security assessments of caching infrastructure. The remediation process should also include thorough code reviews of any custom implementations that interact with the meta protocol handler, ensuring that all user inputs are properly sanitized before being processed by the caching layer. Organizations should consider implementing automated patch management systems to ensure timely application of security updates across all affected systems and dependencies.