cc3305/cve-2025-49844Exploit script for CVE-2025-49844, a use-after-free vulnerability in Redis Lua scripting enabling remote code execution. Targets specific Redis Alpine and Bookworm builds with JOP gadgets.
Use-after-free in Redis Lua scripting leading to remote code execution.
Redis is an open source, in-memory database. CVE-2025-49844 is a use-after-free vulnerability in Redis's embedded Lua scripting engine. An authenticated user with access to Lua scripting can send a specially crafted script that manipulates garbage collection, triggers memory corruption, and can lead to remote code execution outside the Lua sandbox.
The issue affects Redis versions with Lua scripting before the fixed releases. Patching the Redis server is the recommended fix. If patching is not immediately possible, Redis Lua scripting should be restricted with ACLs by denying commands such as EVAL and EVALSHA.
The vulnerability check is broad and verifies an affected Redis version with Lua scripting enabled. The exploit path is much more restrictive because it depends on exact binary layout, build IDs, function offsets, and JOP gadgets.
This script only reliably supports the following:
redis:8.2.1-alpine with build ID f5a80511e802827dredis:8.2.1-bookworm with build ID fcae35583392417fThe command execution has no output.