5 ms·
RediShell: Critical remote code execution vulnerability in Redis
- gizzlon 1y agoyikes, this is bad Would think most forks would be affected as well (?)
- TheDong 1y agoWhy is this bad? Do you run user-authored lua scripts against your redis? Do you have your redis exposed without any authentication on the public internet? If you do either of those, sure, this is bad for you. I've worked with quite a few redis setups and know the details of even more, I do not know a single redis setup which would be vulnerable to this. I've never heard a single instance of someone deciding that redis's lua sandbox is secure enough that they'll let their users upload arbitrary lua code and run it, and trust the lua sandbox to keep that redis box safe. Like, because it's a use-after-free in the lua environment which requires a malicious lua script, this is just such a giant nothing-burger to me and every redis setup I've ever used, all of which only run trusted lua scripts.
- bigiain 1y ago> Do you have your redis exposed without any authentication on the public internet? I will somewhat ashamedly admit to having had a test/development Redis server running on EC2 exploited because I did that. In my defence, it was purely a development/learning exercise and had no real data on it. And it was about 10 years ago. It was an important learning opportunity for me.
- tracker1 1y agoI'm assuming this has also been addressed in Valkey and most prominent forks as well.
- biglyburrito 1y agoWhy would you assume that?
- rpdillon 1y agoLooks like the fix was committed three days ago and they cut a release for version 8.1.4. https://github.com/valkey-io/valkey/commit/6dd003e88feace83e55491f32376f6927896e31e https://github.com/valkey-io/valkey/commit/6dd003e88feace83e... https://github.com/valkey-io/valkey/releases/tag/8.1.4 https://github.com/valkey-io/valkey/releases/tag/8.1.4
- secondcoming 1y agoI'm assuming this is why Ubuntu's unattended-upgrades service uncerimoniously restarted the redis-server process on my machine late September?
- champtar 1y agoGood news that it was found and fixed, but 140 days response time seems rather slow for such a critical vulnerability
- m00x 1y agoprobably due to low exposure
- reconditerose 1y agoSeems similar in impact to https://nvd.nist.gov/vuln/detail/cve-2021-32626 https://nvd.nist.gov/vuln/detail/cve-2021-32626, I wonder why this has a CVE 10. This code also looks generally fixed in Lua5.4, https://github.com/lua/lua/blame/9ea06e61f20ae34974226074fc6123dbb54a07c2/lparser.c#L2116 https://github.com/lua/lua/blame/9ea06e61f20ae34974226074fc6.... Valkey and Redis really need to move to Lua that isn't so old.
- antirez 1y agoLua that isn't too old is not compatible with old Lua, unfortunately.
- reconditerose 1y agoLuaJIT is mostly compatible with 5.1, our goal is to make it pluggable so you can run with either 5.4 or 5.1.
- fletchowns 1y agoThat is unfortunate there's so many Redis instances out there that not only are exposed to the public internet (330,000) and don't have authentication configured (60,000). I'm guessing those folks probably didn't even realize their Redis was public. There are so many tutorials out there for things like Docker Compose that cause people to bind a service to 0.0.0.0 with a port open to the public internet.
- cozzyd 1y agoThat sounds like a bigger problem...
- c0balt 1y agoIn hindsight, making the default listening address for port forwards in docker(-compose) 0.0.0.0 instead of 127.0.0.1 was/is such a pain point for me. Every time I work with it for servers as almost always it should not be directly exposed (usually services are behind a host-side NGINX rev proxy). It also likely has yielded far too many (unintentionally) open services, especially considering dockers known firewall woes with bypassing of existing rules.
- sureglymop 1y agoI agree that it's a bad default. So is their iptables meddling when nftables exists. However, can't you just use e.g. `-p 127.0.0.1:8000:80` since you're aware of the issue? Pretty sure both the CLI and compose support this. What I do is to only use rootless docker/podman and then forward the ports with nftables rules.
- mkesper 1y agoYou can but the __default__ should be the safer option.
- c0balt 1y agoYes, that is also what I apply to compose manifests. The problem is rather that it is always a deviation from defaults and ime can be easily forgotten/ overlooked. It also was at the beginning a bit surprising (listening on 0.0.0.0 and inserting an iptables rule that bypassed my ufw ruleset). Many services listen on on 0.0.0.0 by default but they rarely do it while bypassing the normal host firewall mechanisms.
- notnmeyer 1y ago"RediShell" is an absolutely horrible name that makes it extremely difficult to search for things.
- tptacek 1y agoA post-auth memory corruption vulnerability scores a CVSS 10. Shellshock got like a 9.5. These scores don't mean anything. You can imagine a post-auth Redis vulnerability being deceptively well-exposed, because web apps often give partial control of the Redis key space to attackers, and don't care how long you make your strings. But this one is a UAF that requires attackers to send a malicious Lua script.
- WatchDog 1y agoAgreed, adding to this, if a malicious actor already has the ability to execute arbitrary LUA scripts on your redis instance, then you are probably already pretty screwed.
- tptacek 1y agoI've got nothing bad to say about the vuln research here, I'm sure it's a great bug, just this CVSS stuff is a farce and everyone seriously working in the field seems to agree, but we're just completely path-dependently locked in to it.
- akoboldfrying 1y agoIf the Lua "sandbox" is actually a decent sandbox, then the most you could do before was DoS the box. DoS <<<<< RCE
- akoboldfrying 1y agoI see downvotes but no explanations why -- what is wrong with my claim?
- chucky_z 1y agoI believe the context is that the CVE is that this bypasses the sandbox entirely; so in this specific case this is a real, full-blown RCE. Your comment makes it seem at a glance that you're saying it's a DOS at worse.
- zb3 1y agoPost-auth, so this shouldn't be CVSS 10 (highest possible score), because that implies pre-auth RCE would not be more critical..
- bigiain 1y ago"From time to time I get security reports about Redis. It’s good to get reports, but it’s odd that what I get is usually about things like Lua sandbox escaping, insecure temporary file creation, and similar issues, in a software which is designed (as we explain in our security page here http://redis.io/topics/security http://redis.io/topics/security) to be totally insecure if exposed to the outside world." -- antirez, 4 Nov 2015, https://antirez.com/news/96 https://antirez.com/news/96
- antirez 1y agoYep, however people don't configure things properly so many years ago I introduced a middle ground between not listening to * (which makes things harder for users in actual deployment systems) and leaving the server exposed, that is: protected mode. If Redis has the default configuration to bind all the addresses and no auth is configured, it refuses commands and informs you how to configure it properly. This avoided many security problems, and avoid also the feeling I always had as a user of other systems defaulting to binding to only local interfaces, where you need to understand what to do in order to make it reachable from other computers.
- emkoemko 1y agoWonder if this effects the Sony PS5? could be a cool way to exploit the system? i remember you could somehow connect to the redis server its running and even execute lua scripts but that was it
- kaladin-jasnah 1y agoInteresting. Curious if anyone has more details on the PS5 Redis server? I did not know there was one running on the PS5; I wonder what the console uses it for.
- wwsX0r 1y agoSurprisingly high numbers of exposed instances to the internet and unauth
- darkamaul 1y agoI believe this will be more detailed in the author following talk at HexaCon [0]. They used this bug in Pwn2Own Berlin 2025, earning a 40,000 bounty in the process [1]. [0] https://www.hexacon.fr/conference/speakers/#rce_in_redis https://www.hexacon.fr/conference/speakers/#rce_in_redis [1] https://www.zerodayinitiative.com/blog/2025/5/16/pwn2own-berlin-2025-day-two-results https://www.zerodayinitiative.com/blog/2025/5/16/pwn2own-ber...
- kachapopopow 1y agoThere's only three things that are acceptable when it comes exposing to public internet: a service load balancer, wireguard and ssh(well... for now). There is also an exception with mtls authentication behind a load balancer where the load balancer tanks any kind of malicious / malformed traffic instead of compromising the backend service.
- bawolff 1y agoFeels a little overstated if it requires a malicious lua script. Yes that's bad, but its not critical the way the article implies. For the average website, your average stored XSS is probably more impactful.
- rickette 1y agoExactly, also requires authentication. How can this be 10/10?
- ockside 1y agoHas anyone started rewriting Redis in Rust yet? If bugs like this can lay hidden for over a decade, maybe it's about time.
- VWWHFSfQ 1y agoThey've been too busy adding multi threading. If a trivial UAF existed for more than a decade, then I can't wait to see what smorgasbord of memory bugs they introduced with threads.
- lyu07282 1y agoDamn people really love redis, considering everyone running to defend it, just to clarify a few things: You need to configure auth explicitly there is no auth by default, Lua scripts are part of the protocol they aren't uploaded separately to the server or something, they are enabled by default.