Redis Lua脚本 UAF漏洞 可导致远程代码执行

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://redis.io/blog/security-advisory-cve-2025-49844/
• https://cloud.tencent.com/developer/article/2584500
• https://blog.csdn.net/seoppg/article/details/152666934
• https://avd.aliyun.com/detail?id=AVD-2024-46981
• https://cloud.tencent.com/developer/article/2574448
• https://github.com/MiclelsonCN/CVE-2025-49844_POC
• https://www.wiz.io/blog/wiz-research-redis-rce-cve-2025-49844
• https://securityaffairs.com/183097/security/redis-patches-13-year-old-lua-flaw-enabling-remote-code-execution.html
• https://nvd.nist.gov/vuln/detail/CVE-2025-49844
• https://github.com/dwisiswant0/CVE-2025-49844

Related Vulnerabilities

• PoCredis-exporter-metrics: Redis Exporter Metrics - Exposure
• Redis-commander /signin 默认口令漏洞
• PoCredis-commander-default-login: Redis Commander - Default Login
• Redis XACKDEL 缓冲区溢出漏洞
• Redis 存在远程代码执行漏洞(CVE-2025-49844)
• Redis Lua 脚本 代码执行漏洞（CVE-2025-49844）
• PoCCVE-2022-0543: Redis Sandbox Escape - Remote Code Execution
• PoCec2-unrestricted-redis: Unrestricted Redis Access
• PoCcache-redis-encryption-disabled: ElastiCache Redis In-Transit and At-Rest Encryption - Disabled
• PoCcache-redis-multiaz-disabled: ElastiCache Redis Multi-AZ - Disabled