1. Upload malicious .so (shared object) file to the Redis server.
2. Use the MODULE LOAD command to load the module.
3. Achieve remote code execution 💣

🧪 Tested On:

Redis 7.2.3 and below

🚫 Not Affected:

Redis 7.2.4 and above

🛡️ Mitigation Steps:

• ✅ Upgrade to Redis 7.2.4+
• 🔐 Use ACLs or set a strong requirepass
• 🧱 Block external access via firewall
• 📛 Disable MODULE LOAD if not needed

⚠️ Security Tip:

Never expose Redis directly to the internet without proper authentication, ACLs, and network restrictions. Redis is meant to be internal.

🧩 CVSS Score: 9.8 (Critical)

🧬 Discovered By: Security researchers in early 2025.