Scanner and educational guide for CVE-2025-49844 (RediShell), a Redis Lua scripting use-after-free vulnerability. Checks Redis servers for exposure, provides remediation steps, and explains the exploit mechanics for learning purposes.
Hey! This is a simple tool I made to help people check if their Redis servers are vulnerable to the bug. It's not meant for actual attacks - just for learning and protecting your own stuff.
Alright my lovely people, here's one of the most interesting fuckups of 2025, CVE-2025-49844. Essentially, if someone can run Lua scripts on your Redis server, they can gain access to the memory.
# First, get the Go stuff ready
cd scanner
go mod tidy
# Then build the scanner
go build -o rscan redis-scanner.go
# Check one server
./rscan -host your-server.com -port 6379
# Check with a password (if you have one)
./rscan -host your-server.com -port 6379 -auth yourpassword
# Check a bunch at once
./rscan -host server1.com,server2.com,server3.com
# Or check from a file
./rscan -file hosts.txt
# Turn off Lua scripting (this stops the attack)
redis-cli ACL SETUSER default -@scripting
# Or just update Redis to the newest version
This is what is called a "use-after-free" bug. Essentially, Redis has a memory management system that sometimes gets confused about what memory it's already cleaned up.
How It Should Work:
How It Actually Works (The Bug):
EVAL and EVALSHA (these run Lua scripts)# Turn off Lua scripts (this stops the attack)
redis-cli ACL SETUSER default -@scripting
# Or edit your redis.conf file and add this line:
disable-commands eval evalsha
# Then restart Redis
sudo systemctl restart redis
# Only allow specific IPs to connect to Redis
iptables -A INPUT -p tcp --dport 6379 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 6379 -j DROP
# Make Redis only listen on specific network interfaces
bind 127.0.0.1 10.0.0.100
# Set a strong password
redis-cli CONFIG SET requirepass "fuckredis1234ilovehacking!"
# Create users with limited permissions
redis-cli ACL SETUSER appuser on >password +@read +@write -@scripting
redis-cli ACL SETUSER readonly on >password +@read -@scripting
# Backup your data first (always do this!)
sudo cp -r /var/lib/redis /var/lib/redis.backup.$(date +%Y%m%d)
# Update Redis to the fixed version
# On Ubuntu/Debian:
sudo apt update && sudo apt install redis-server=8.2.2*
# On CentOS/RHEL:
sudo yum update redis
# Check that it worked
redis-server --version
# This should fail if your fix is working
redis-cli -a "YourPassword" EVAL "return 'test'" 0
# Should say: (error) ERR unknown command 'EVAL'
# See if Redis is accessible from the network
nmap -p 6379 your-redis-server
# Test if password is required
redis-cli -h your-redis-server -p 6379 ping
# Should ask for password
# Look for weird Lua script activity
grep -i "eval\|evalsha" /var/log/redis/redis.log
# Check for failed login attempts
grep -i "auth" /var/log/redis/redis.log
# Look for script errors
grep -i "script" /var/log/redis/redis.log
eval and evalsha commands)The bug happens when:
-- This is just to show you what the structure looks like
local function create_memory_pattern()
-- Create objects that mess with Redis's memory cleanup
local objects = {}
for i = 1, 1000 do
objects[i] = {data = "pattern_" .. i}
end
return objects
end
local function trigger_gc()
-- Force Redis to clean up memory at the wrong time
collectgarbage("collect")
-- This is where the memory bug happens
end
-- Main attack structure
local objects = create_memory_pattern()
-- Mess with memory references
-- Force garbage collection
-- Use the broken memory to run code
If you want to see how this works without breaking anything real, you can use Docker:
# Start a test Redis (this one is vulnerable)
docker run -d --name redis-test -p 6379:6379 redis:6.0
# Test it
cd scanner
./rscan -host localhost -port 6379
# Stop the vulnerable one and start a fixed one
docker stop redis-test
docker run -d --name redis-fixed -p 6379:6379 redis:6.0 redis-server --rename-command EVAL "" --rename-command EVALSHA ""
./rscan -host localhost -port 6379
# Clean up when you're done
docker stop redis-fixed && docker rm redis-fixed
cd scanner
./rscan --help
Create a hosts.txt file like this:
# Put your servers here
server1.com
server2.com:6380
192.168.1.100
redis.example.com:6379
# Use more workers to scan faster (if you have lots of servers)
./rscan -host server1.com,server2.com -workers 20
# Rollback to your backup
sudo systemctl stop redis
sudo rm -rf /var/lib/redis
sudo cp -r /var/lib/redis.backup.$(date +%Y%m%d) /var/lib/redis
sudo systemctl start redis
This is just for learning and protecting your own stuff. Don't use it to hack other people's servers - that's illegal. Don't be dumb.