Full Report
Wiz Research discovers vulnerability stemming from 13-year-old bug present in all Redis versions, used in 75% of cloud environments.
Analysis Summary
# Vulnerability: Redis Critical Remote Code Execution via Use-After-Free (RediShell)
## CVE Details
- CVE ID: CVE-2025-49844
- CVSS Score: 10.0 (Critical)
- CWE: Use-After-Free (Implied, tied to memory corruption)
## Affected Systems
- Products: Redis (in-memory data structure store)
- Versions: All Redis versions (vulnerability exists in source code for approximately 13 years)
- Configurations: Instances where an attacker can send a specially crafted Lua script post-authentication, or unauthenticated instances exposed to the internet (which often lack default authentication).
## Vulnerability Description
This vulnerability, dubbed #RediShell, is a critical Remote Code Execution (RCE) flaw stemming from a 13-year-old Use-After-Free (UAF) memory corruption bug present in the Redis source code. A post-authentication attacker can exploit this flaw by sending a malicious Lua script. Because Lua scripting is supported and enabled by default, the flaw permits the attacker to escape the default Lua sandbox context and achieve arbitrary native code execution on the host system running Redis.
## Exploitation
- Status: PoC available (Implied, though specific exploit details are being withheld publicly for remediation time)
- Complexity: Medium (Requires authenticated access, but exploitation path via Lua scripting is inherent to the service)
- Attack Vector: Network
## Impact
- Confidentiality: High (Full access to host allows data exfiltration)
- Integrity: High (Ability to wipe or modify data/system configuration)
- Availability: High (Ability to disrupt service, encrypt data, or hijack resources)
## Remediation
### Patches
- Organizations are strongly urged to update their Redis instances to the **latest patched version** released by Redis on October 3, 2025. (Specific patched version number is not detailed in the summary but implied to be the newest release).
### Workarounds
- Immediately apply access controls to prevent unauthorized access to Redis instances.
- Prioritize patching instances that are exposed to the internet.
- Ensure strong authentication is configured wherever possible, especially for internet-facing instances (the report notes default container images often lack this).
## Detection
- Indicators of Compromise: Look for suspicious network activity targeting Redis (typically port 6379) communicating unexpected or overly complex Lua command sets, especially from external/untrusted sources. Successful exploitation results in arbitrary code execution on the host, which should trigger host-level process monitoring alerts.
- Detection methods and tools: Standard network monitoring and endpoint detection tools looking for unusual process execution originating from the Redis process context.
## References
- Vendor Advisory: https://redis.io/blog/security-advisory-cve-2025-49844/
- Research Blog: https://www.wiz.io/blog/wiz-finds-critical-redis-rce-vulnerability-cve-2025-49844
- CVSS Link: https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q