{"id":144522,"date":"2025-10-09T11:12:23","date_gmt":"2025-10-09T09:12:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd"},"modified":"2025-10-09T11:12:23","modified_gmt":"2025-10-09T09:12:23","slug":"uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-redis-i-valkey-pozvolyayushhie-vypolnit-kod-na-servere-pri-nalichii-dostupa-k-bd","title":{"rendered":"Vulnerabilities in Redis and Valkey that allow code execution on the server with database access.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from Wiz have identified a vulnerability (CVE-2025-49844) in the Redis DBMS that allows for remote code execution (RCE) on the server. The issue has been assigned the highest danger level (CVSS score of 10 out of 10), and to exploit this vulnerability, an attacker must be able to send requests to the Redis DBMS that permits the execution of user-defined Lua scripts. <\/p>\n
In addition to publicly accessible Redis instances that allow access without authentication, the vulnerability enables compromise of cloud systems and hosting platforms that support services for working with Redis. According to Wiz, network scanning has revealed approximately 330,000 Redis servers accepting connections, of which around 60,000 allow requests without authentication. The official Docker container image provided by the Redis project is configured for unauthenticated access by default. <\/p>\n
The vulnerability is caused by accessing already freed memory (use-after-free), which manifests during garbage collector manipulation from a specially crafted Lua script. This issue allows bypassing the sandbox isolation of the Lua environment in Redis and executing code on the host system with the permissions of the user under which the DBMS is running. Notably, this flaw remained unnoticed for 13 years. Researchers who uncovered the issue demonstrated a working exploit, but details of the exploitation remain undisclosed to allow time for updates to be implemented. <\/p>\n
The vulnerability is also present in the Valkey project, which develops a fork of Redis included in most Linux distributions, including RedHat Enterprise Linux 10. The vulnerability has been patched in Redis versions 8.2.2, 8.0.4, 7.4.6, 7.2.11, and 6.2.20, as well as in Valkey versions 8.1.4, 8.0.6, and 7.2.11. The status of the new version of the package or the preparedness of a patch in the distributions can be checked on the following pages: Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo, Arch, FreeBSD, OpenBSD, and NetBSD. As a workaround for protection in the DBMS, Lua script execution can be disabled by prohibiting the EVAL and EVALSHA commands through ACL. <\/p>\n
Additionally, three more vulnerabilities that are exploitable via Lua scripts and have been patched in the latest versions of Redis and Valkey can be noted. For circumstantial protection against these vulnerabilities, the EVAL and FUNCTION command families can be prohibited through ACL. <\/p>\n