#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Local-only mitigation for CVE-2025-49844 (RediShell) — disable Redis Lua by # ensuring rename-command EVAL "" and rename-command EVALSHA "" in redis.conf. # # DESCRIPTION # Identifies a local redis-server binary (./src/, ./, PATH, common paths), # extracts the version from the binary and determines whether it is patched # for CVE-2025-49844 using the same branch-aware rules as the detector. # # If the binary is an unpatched release, the script finds redis.conf from a # list of common locations, creates a timestamped backup and idempotently # inserts or replaces: # rename-command EVAL "" # rename-command EVALSHA "" # # The script does NOT restart Redis. It prints a clear suggestion to restart # the Redis process/service manually so the changes take effect. # # VARIABLES TO DEFINE: # # None required. You may edit CONF_CANDIDATES / CANDIDATES arrays inside # # the script to add custom redis.conf/binary locations. # # WARNINGS: # # - This is a no-patch mitigation. It disables Lua globally and may break # # applications that rely on EVAL/EVALSHA. # # - The script modifies redis.conf and creates a backup file alongside it. # # - The script does NOT restart Redis. You must restart the service to # # apply changes; a restart step is intentionally omitted. # # EXECUTION # Make executable then run: # chmod +x ./mitigate-redis-rename-eval.sh # ./mitigate-redis-rename-eval.sh # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== set -euo pipefail say(){ printf "%s\n" "$*"; } # ---- Binary search order (same spirit as your detector) ---- CANDIDATES=( "./src/redis-server" "./redis-server" "/root/redis/src/redis-server" "/root/redis-server" "/usr/local/bin/redis-server" "/usr/bin/redis-server" "/opt/redis/bin/redis-server" "/snap/bin/redis-server" ) try_path_after_candidates=true # ---- Config search order ---- CONF_CANDIDATES=( "./redis.conf" "./src/redis.conf" "/root/redis/redis.conf" "/root/redis/src/redis.conf" "/etc/redis/redis.conf" "/etc/redis.conf" "/usr/local/etc/redis/redis.conf" "/usr/local/etc/redis.conf" ) extract_version_from_binary() { local bin="$1" out out=$("$bin" --version 2>/dev/null || true) if [[ -n "$out" ]]; then if [[ $out =~ v=([0-9]+\.[0-9]+\.[0-9]+) ]]; then printf '%s' "${BASH_REMATCH[1]}"; return 0; fi if [[ $out =~ version[[:space:]]*([0-9]+\.[0-9]+\.[0-9]+) ]]; then printf '%s' "${BASH_REMATCH[1]}"; return 0; fi if [[ $out =~ ([0-9]+\.[0-9]+\.[0-9]+) ]]; then printf '%s' "${BASH_REMATCH[1]}"; return 0; fi fi if command -v strings >/dev/null 2>&1; then out="$(strings "$bin" 2>/dev/null | grep -Eo '([0-9]+\.[0-9]+\.[0-9]+)' | head -n1 || true)" if [[ -n "$out" ]]; then printf '%s' "$out"; return 0; fi fi return 1 } parse_version(){ IFS='.' read -r M m p <<<"$1"; printf '%d %d %d' $((10#${M:-0})) $((10#${m:-0})) $((10#${p:-0})); } ver_lt(){ read -r a1 a2 a3 <<<"$(parse_version "$1")" read -r b1 b2 b3 <<<"$(parse_version "$2")" ((a1b1)) && return 1 ((a2b2)) && return 1 ((a3/dev/null 2>&1; then printf '%s' "$(command -v redis-server)"; return 0 fi return 1 } apply_rename_commands_to_conf(){ local conf="$1" tmp ts ts="$(date '+%Y%m%d-%H%M%S')" cp -p "$conf" "${conf}.bak.${ts}" tmp="$(mktemp --tmpdir "redisconf.XXXX")" awk ' BEGIN { e=0; s=0; } { lc=tolower($0) if (lc ~ /^[[:space:]]*rename-command[[:space:]]+eval[[:space:]]+/){ print "rename-command EVAL \"\""; e=1; next } if (lc ~ /^[[:space:]]*rename-command[[:space:]]+evalsha[[:space:]]+/){ print "rename-command EVALSHA \"\""; s=1; next } print $0 } END { if (e==0) print "rename-command EVAL \"\"" if (s==0) print "rename-command EVALSHA \"\"" } ' "$conf" > "$tmp" mv -f "$tmp" "$conf" chmod --reference="${conf}.bak.${ts}" "$conf" 2>/dev/null || true say "[+] Config updated: $conf" say " Backup created: ${conf}.bak.${ts}" } # -------- main -------- bin="$(find_redis_binary || true)" if [[ -z "$bin" ]]; then say "ERROR: No redis-server binary found (checked current dir, ./src, PATH and common locations)." exit 1 fi say "Found redis binary: $bin" version="$(extract_version_from_binary "$bin" || true)" if [[ -z "$version" ]]; then say "ERROR: Could not extract Redis version from $bin." exit 3 fi say "Detected version: $version" if is_patched_for_cve "$version"; then say "INFO: Version is patched for CVE-2025-49844 — mitigation not required." exit 0 fi # Find redis.conf conf="" for c in "${CONF_CANDIDATES[@]}"; do [[ -f "$c" ]] && { conf="$c"; break; } done if [[ -z "$conf" ]]; then say "ERROR: Could not find redis.conf. Searched:" printf ' - %s\n' "${CONF_CANDIDATES[@]}" say "Tip: run server with an explicit conf path, or place redis.conf next to this script." exit 2 fi apply_rename_commands_to_conf "$conf" say "" say "NEXT STEP: Restart your Redis service/process to apply changes." say "Examples:" say " systemctl restart redis-server # or: redis, redis@INSTANCE" say " service redis-server restart" say " (or stop/start the process you launched with ./src/redis-server ./redis.conf)" say "" say "After restart, EVAL/EVALSHA should be disabled via rename-command." exit 0

Description