#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Local-only Redis binary detection for CVE-2025-49844 (RediShell). # # DESCRIPTION # Detects whether a local redis-server binary is vulnerable to CVE-2025-49844 # by locating redis-server in common local paths (./src/, ./, PATH, common # install locations), extracting the semantic version from the binary # (via `--version` output or `strings` fallback) and comparing it to the # branch-aware patched versions: # - 8.2.2+ # - 8.0.4+ # - 7.4.6+ # - 7.2.11+ # - 6.2.20+ # # This script performs an offline check only — it does NOT connect to any # running Redis instance, does not use redis-cli, and makes no changes to # system state. # # VARIABLES TO DEFINE: # # None required. Adjust CANDIDATES array inside the script to include # # additional local candidate paths if desired. # # WARNINGS: # # - The script inspects local binaries and may run `strings` on them as a # # fallback (can be slow on large binaries). # # - Designed for local audit/lab use. Use caution when copying binaries # # from untrusted sources. # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== set -euo pipefail # Locations to look for binary (order matters) CANDIDATES=( "./src/redis-server" "./redis-server" "/root/redis/src/redis-server" "/root/redis-server" "/usr/local/bin/redis-server" "/usr/bin/redis-server" "/opt/redis/bin/redis-server" "/snap/bin/redis-server" ) try_path_after_candidates=true say(){ printf "%s\n" "$*"; } # Try to extract semver from redis-server --version output or from binary strings extract_version_from_binary() { local bin="$1" out out=$("$bin" --version 2>/dev/null || true) if [[ -n "$out" ]]; then if [[ $out =~ v=([0-9]+\.[0-9]+\.[0-9]+) ]]; then printf '%s' "${BASH_REMATCH[1]}"; return 0 fi if [[ $out =~ version[[:space:]]*([0-9]+\.[0-9]+\.[0-9]+) ]]; then printf '%s' "${BASH_REMATCH[1]}"; return 0 fi if [[ $out =~ ([0-9]+\.[0-9]+\.[0-9]+) ]]; then printf '%s' "${BASH_REMATCH[1]}"; return 0 fi fi if command -v strings >/dev/null 2>&1; then out="$(strings "$bin" 2>/dev/null | grep -Eo '([0-9]+\.[0-9]+\.[0-9]+)' | head -n1 || true)" if [[ -n "$out" ]]; then printf '%s' "$out"; return 0 fi fi return 1 } # parse version into integers parse_version() { local v="$1" IFS='.' read -r maj min patch <<< "$v" maj=${maj:-0}; min=${min:-0}; patch=${patch:-0} maj=$((10#$maj)); min=$((10#$min)); patch=$((10#$patch)) printf '%d %d %d' "$maj" "$min" "$patch" } # A < B ? return 0 if true ver_lt() { read -r a1 a2 a3 <<< "$(parse_version "$1")" read -r b1 b2 b3 <<< "$(parse_version "$2")" if (( a1 < b1 )); then return 0; fi if (( a1 > b1 )); then return 1; fi if (( a2 < b2 )); then return 0; fi if (( a2 > b2 )); then return 1; fi if (( a3 < b3 )); then return 0; fi return 1 } # returns 0 if version is patched for CVE-2025-49844 is_patched_for_cve() { local v="$1" # patched branches: 8.2.2+, 8.0.4+, 7.4.6+, 7.2.11+, 6.2.20+ if ! ver_lt "$v" "8.2.2"; then return 0; fi read -r maj min patch <<< "$(parse_version "$v")" if (( maj == 8 && min == 0 )); then if ! ver_lt "$v" "8.0.4"; then return 0; fi fi if (( maj == 7 && min == 4 )); then if ! ver_lt "$v" "7.4.6"; then return 0; fi fi if (( maj == 7 && min == 2 )); then if ! ver_lt "$v" "7.2.11"; then return 0; fi fi if (( maj == 6 && min == 2 )); then if ! ver_lt "$v" "6.2.20"; then return 0; fi fi return 1 } found_bin="" found_ver="" for p in "${CANDIDATES[@]}"; do if [[ -x "$p" ]]; then found_bin="$p" if ver="$(extract_version_from_binary "$p")"; then found_ver="$ver" fi break fi done if [[ -z "$found_bin" && "$try_path_after_candidates" == "true" ]]; then if command -v redis-server >/dev/null 2>&1; then candidate="$(command -v redis-server)" if [[ -x "$candidate" ]]; then found_bin="$candidate" if ver="$(extract_version_from_binary "$candidate")"; then found_ver="$ver" fi fi fi fi if [[ -z "$found_bin" ]]; then say "No redis-server binary found in current folder, ./src, PATH or common locations." exit 2 fi say "Found binary: $found_bin" if [[ -z "${found_ver:-}" ]]; then say "ERROR: Could not extract version from binary." exit 3 fi say "Detected version: $found_ver" if is_patched_for_cve "$found_ver"; then say "Result: NOT VULNERABLE (version patched or newer)." exit 0 else say "Result: VULNERABLE to CVE-2025-49844 (unpatched version)." exit 0 fi

Description