CVE-2025-49844 PoC — Redis 资源管理错误漏洞

Source

Associated Vulnerability

Description

Untested completition of the Redishell PoC made by AI

Readme

# CVE-2025-49844 RediShell
AI-made Revshell PoC

<s>Untested completition of the Redishell PoC made by AI. </s>

Original PoC:  
https://github.com/raminfp/redis_exploit/blob/main/exploit_poc.py 

Korean Piece:  
https://github.com/dwisiswant0/CVE-2025-49844/blob/master/CVE-2025-49844.lua

## Progress ? 
We later went ahead and plugged in GDB - we managed to get the Base address and find out a few more things, but most of it all, it appears this isn't a simple Heap vuln. No matter what we tried, it was impossible to get code execution. Crashing? Yes. Commands? No. 

We're no longer firm in reversing, so we can't be sure, but from all we found over hours with the help of some of the strongest AI models, it's not possible to get code execution through this vuln (or it's one out of a thousand attempts but that's just pure guesswork).

Through numerous attempts, we always landed somewhere here at best:
```bash
Script attempted to access nonexistent global variable 'print' script: 67dfac1cecac4f99df897c7a0713f1d6fcef69a4, on @user_script:21.
```

Curious to see the real PoC with code execution. 

READ PROPERLY PLEASE: We said, FROM ALL WE KNOW / HAVE SEEN YET. That's not an absolute statement, there may be a trick or treat we haven't considered, there's way better BinExers out there. 

![](./redis_cve_2025.JPG)

## Other attempts
Note that Redis Server remained stable - we pulled it out of docker for testing. You can trigger the crash by firing the exploit a couple thousand times and we haven't yet tried to combine this bruteforce method with attempts of code execution, it may be the solution.

![](./redis_cve_2025_02.JPG)

## Original PoC
As you see, the original PoC seems to struggle from the same issues, it claims to be "simplified" while it's not entirely clear, what the result is supposed to be.

![](./redis_cve_2025_03.JPG)

## Korean Puzzle Piece
Nothin yet...

```bash
$ while redis-cli -h localhost -p 6380 --eval korean.lua; do printf '.'; done
```

![](./redis_cve_2025_04.JPG)

## The saga continues...
Mysteriously, in Redis patch notes, a completely different CVE is listed - also supposedly a Binary Exploit, but a much simpler one, a stack-based Buffer Overflow with supposed RCE:  

#### CVE-2025-62507 - Bug in `XACKDEL` may lead to stack overflow and potential RCE  

https://github.com/redis/redis/compare/8.2.2...8.2  

We found even less information on this. It's already challenging to find a non-backported version without self-compile but maybe that's the route we'll have to take then.

All these `POTENTIALS` - I got potential. Now I got 2 potentials.

## Boing - Indeed a crash, sir!
62507 is the way to go... don't have RCE yet, but it looks easy and promissing...

![](./redis_cve_2025-62507.JPG)

## Final Words
So was CVE-2025-49844 just a ruse? The Korean Puzzle still hasnt produced a crash - but it produces completely different output against our self-compiled 8.2.2. Having to admit, even I tapped into thinking "yeah, crash, more than plausible, probably easy..." and just assumed, the crash part of CVE-2025-49844 would be working. But it never did. Sorry for saying it wrong before, but it's cleared now, hopefully. CVE-2025-49844 doesn't crash, CVE-2025-62507 does crash.

```bash
.(error) ERR user_script:16: Script attempted to access nonexistent global variable 'newproxy' script: 859491190bfb66357ec83aee16eb0554967c9c38, on @user_script:16.
```

Looks familiar? IDK What they did there... or if nobody checked other than me? The world has become a rather strange place lately. 

File Snapshot

 [4.0K]  /data/pocs/59170c16475c8c37b4be82055556a43cb8296241
├── [2.1K]  CVE-2025-62507_Crash_Working_PoC_BufferOverflow.py.
├── [4.5K]  exploit_poc_another_attempt.py
├── [3.9K]  exploit_poc_another_one.py
├── [5.9K]  exploit_poc_one_more_attempt.py
├── [ 10K]  exploit_poc.py
├── [3.9K]  exploit.py
├── [4.0K]  find_base.py
├── [1.1K]  korean_puzzle_piece.lua
├── [3.5K]  README.md
├── [347K]  redis_cve_2025_02.JPG
├── [120K]  redis_cve_2025_03.JPG
├── [190K]  redis_cve_2025_04.JPG
├── [394K]  redis_cve_2025-62507.JPG
├── [400K]  redis_cve_2025.JPG
└── [ 554]  test-breakpoint.py

1 directory, 15 files

Remarks