#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Check Redis vulnerability to CVE-2025-46819. # # OUTPUT # Clear decisions only: # [-]/[+] Version status: VULNERABLE | SAFE # [-]/[+] Config status: NOT MITIGATED | MITIGATED # And per-command: EVAL/EVALSHA/FUNCTION → Vulnerable | Not Vulnerable # # VARIABLES # REDIS_CONF - optional explicit config path (if unset, auto-detect tries defaults) # REDIS_CLI_OPTS - redis-cli opts (e.g., "-h 127.0.0.1 -p 6380") # REDIS_PASSWORD - optional redis password for redis-cli (-a) # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== set -euo pipefail # Loggin helpers info(){ echo "[i] $*"; } good(){ echo "[+] $*"; } warn(){ echo "[!] $*"; } bad(){ echo "[-] $*"; } trim(){ sed 's/^[[:space:]]*//; s/[[:space:]]*$//' <<<"$1"; } auto_detect_conf() { local -a candidates=( "/etc/redis/redis.conf" "/usr/local/etc/redis/redis.conf" "/opt/redis/redis.conf" "$(pwd)/redis.conf" ) local c for c in "${candidates[@]}"; do if [[ -f "$c" ]]; then printf '%s' "$c" return 0 fi done printf '%s' "" return 1 } ver_ge(){ local A="$(trim "$1")" B="$(trim "$2")" [[ "$(printf '%s\n%s\n' "$B" "$A" | sort -V | head -n1)" == "$B" ]] } get_runtime_version(){ command -v redis-cli >/dev/null 2>&1 || return 1 local auth_args=() [[ -n "${REDIS_PASSWORD:-}" ]] && auth_args=(-a "$REDIS_PASSWORD") _try_info(){ local out line ver if out="$(redis-cli "$@" "${auth_args[@]}" INFO server 2>/dev/null)"; then line="$(printf '%s\n' "$out" | grep -m1 '^redis_version:')" || return 1 ver="${line#redis_version:}" ver="$(printf '%s' "$ver" | tr -d '\r' | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')" [[ -n "$ver" ]] || return 1 printf '%s' "$ver" return 0 fi return 1 } if [[ -n "${REDIS_CLI_OPTS:-}" ]] && _try_info ${REDIS_CLI_OPTS}; then return 0; fi _try_info -h 127.0.0.1 -p 6380 && return 0 _try_info -h 127.0.0.1 -p 6379 && return 0 return 1 } is_patched_for_cve(){ local v="$(trim "$1")" if ver_ge "$v" "8.2.2"; then return 0; fi if [[ "$v" == 8.0.* ]] && ver_ge "$v" "8.0.4"; then return 0; fi if [[ "$v" == 7.4.* ]] && ver_ge "$v" "7.4.6"; then return 0; fi if [[ "$v" == 7.2.* ]] && ver_ge "$v" "7.2.11"; then return 0; fi if [[ "$v" == 6.2.* ]] && ver_ge "$v" "6.2.20"; then return 0; fi return 1 } label_vuln(){ if [[ "${1:-NO}" == "YES" ]]; then printf '%s' "Not Vulnerable" else printf '%s' "Vulnerable" fi } check_conf_flags(){ local conf="$1" content e s f if [[ -z "$conf" || ! -f "$conf" ]]; then warn "redis.conf not found at: ${conf:-}" echo "CONF:NOT_FOUND" return 0 fi content="$(tr -d '\r' < "$conf" | sed 's/[[:space:]]\+/ /g' | tr '[:upper:]' '[:lower:]')" if grep -qE "^[[:space:]]*rename-command[[:space:]]+eval([[:space:]]+|[[:space:]]*[\"'])([[:space:]]*)[\"']" <<<"$content"; then e="YES"; else e="NO"; fi if grep -qE "^[[:space:]]*rename-command[[:space:]]+evalsha([[:space:]]+|[[:space:]]*[\"'])([[:space:]]*)[\"']" <<<"$content"; then s="YES"; else s="NO"; fi if grep -qE "^[[:space:]]*rename-command[[:space:]]+function([[:space:]]+|[[:space:]]*[\"'])([[:space:]]*)[\"']" <<<"$content"; then f="YES"; else f="NO"; fi echo "CONF_PATH:$conf" echo "CONF_EVAL_DISABLED:$e" echo "CONF_EVALSHA_DISABLED:$s" echo "CONF_FUNCTION_DISABLED:$f" } main(){ local ver="unknown" version_status config_status if ver="$(get_runtime_version)"; then info "Runtime version: $ver" else warn "Could not read runtime version via redis-cli INFO." fi if [[ "$ver" != "unknown" ]] && is_patched_for_cve "$ver"; then good "Version status: SAFE (PATCHED)" version_status="SAFE (PATCHED)" else bad "Version status: VULNERABLE" version_status="VULNERABLE" fi local conf_path="${REDIS_CONF:-}" if [[ -z "${conf_path}" || ! -f "${conf_path}" ]]; then conf_path="$(auto_detect_conf || true)" fi readarray -t conf_report < <(check_conf_flags "$conf_path") local path de ds df nf path="$(printf '%s\n' "${conf_report[@]}" | awk -F: '/^CONF_PATH:/{print $2}')" de="$(printf '%s\n' "${conf_report[@]}" | awk -F: '/^CONF_EVAL_DISABLED:/{print $2}')" ds="$(printf '%s\n' "${conf_report[@]}" | awk -F: '/^CONF_EVALSHA_DISABLED:/{print $2}')" df="$(printf '%s\n' "${conf_report[@]}" | awk -F: '/^CONF_FUNCTION_DISABLED:/{print $2}')" nf="$(printf '%s\n' "${conf_report[@]}" | awk -F: '/^CONF:NOT_FOUND/{print $2}')" if [[ -n "$nf" ]]; then warn "Config status: redis.conf NOT FOUND" config_status="NOT MITIGATED" else info "Config path: ${path}" info "EVAL: $(label_vuln "${de:-NO}")" info "EVALSHA: $(label_vuln "${ds:-NO}")" info "FUNCTION: $(label_vuln "${df:-NO}")" if [[ "${de:-NO}" == "YES" && "${ds:-NO}" == "YES" && "${df:-NO}" == "YES" ]]; then good "Config status: MITIGATED" config_status="MITIGATED" else bad "Config status: NOT MITIGATED" config_status="NOT MITIGATED" fi fi exit 0 } main "$@"

PoC video

Description