dwisiswant0
Source-scoped identity with 12 associated PoCs and 11 linked vulnerabilities.
Exploit catalog results
Showing 12 PoCs on this page
GitHubdwisiswant0/CVE-2025-49844
Repository PoCStars: 66Created 2025-10-07ExploitCVE-2025-498442 files
Analysis
Technical assessment
Lua script that triggers a use-after-free in Redis by racing garbage collection during Lua script parsing, aiming for remote code execution.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Lua script and a README that together demonstrate a proof-of-concept for CVE-2025-49844, a use-after-free vulnerability in Redis Lua scripting. The Lua script constructs a payload designed to trigger garbage collection during parsing to revive a freed chunk name, and the README describes how to run it against a vulnerable Redis server. No backdoor, concealed operator-directed harm, credential theft, persistence mechanism, or unrelated payload is present. The artifact's behavior is entirely consistent with a legitimate PoC for the stated CVE.
Classification basis and observed behavior
Classification basis
The Lua script actively attempts to trigger a use-after-free vulnerability by racing garbage collection during parsing, which is exploitation behavior. The README explicitly states it leads to 'remote code execution' and expects a crash on vulnerable builds.
CVE-2025-49844.lua:1README.md:3README.md:7README.md:29Requirements
- Authenticated access to a Redis instance with Lua scripting enabled.
README.md:11-13 - Redis server version 8.2.1 or earlier (vulnerable).
README.md:11
Observed behavior
- Creates a Lua chunk name with a finalizer that forces garbage collection.
CVE-2025-49844.lua:15-22 - Repeatedly calls loadstring with the crafted chunk name to trigger a use-after-free during parsing.
CVE-2025-49844.lua:26-30 - Generates heap churn to increase the likelihood of garbage collection during parsing.
CVE-2025-49844.lua:31-37 - Expected result is a crash or dropped connection on vulnerable builds.
README.md:29
Behaviors behind the backdoor verdict
Observables
- Vulnerability Exploit Mechanism
- Payload withheldThis is the core mechanism of the PoC for CVE-2025-49844, as described in the CVE record and the README.
CVE-2025-49844.lua:15-22CVE-2025-49844.lua:26-27 - Target Environment
- Payload withheldThe README specifies the vulnerable environment and usage instructions, which align with the CVE description.
README.md:9-13README.md:21-25 - Expected Behavior
- Payload withheldThis is the stated outcome of the PoC, consistent with a use-after-free vulnerability demonstration.
README.md:27-29
What the analysis did not establish
- The evidence does not include the final payload for remote code execution; the script only triggers the use-after-free and expects a crash.
- The script's success depends on a race condition and may require multiple runs, as noted in the return message.
- Only the two text files (CVE-2025-49844.lua and README.md) were supplied; no other files from the repository were reviewed.
- The review is based solely on static analysis of the provided text; the script was not executed, and its runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubdwisiswant0/CVE-2025-46819
Repository PoCStars: 0Created 2025-10-07ExploitCVE-2025-468192 files
Analysis
Technical assessment
The artifact is a Lua script that constructs a malformed long-string delimiter to trigger an out-of-bounds read in the Redis Lua lexer, leading to a server crash or denial of service.
Backdoor review
No backdoor observed in reviewed code
The artifact contains a Lua script and README that demonstrate a publicly documented payload withheld vulnerability in Redis. The script constructs a malformed long-string delimiter to trigger an out-of-bounds read or crash in vulnerable Redis versions. No backdoor, deceptive payload, or concealed operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The Lua script is designed to exercise the payload withheld vulnerability by crafting a specific input that causes a crash. The README explicitly states it 'constructs a huge malformed delimiter and feeds it to loadstring' and that the expected result on vulnerable versions is a crash or 'ERR C stack overflow'. This is code intended to exploit a vulnerability, not merely detect it.
CVE-2025-46819.lua:1-2README.md:17README.md:27Requirements
- Authenticated access to a Redis server running a vulnerable version (<= 8.2.1) with Lua scripting enabled.
CVE-2025-46819.lua:3README.md:11-13
Observed behavior
- Constructs a massive string separator (~1 GB) using string.rep and table.concat.
CVE-2025-46819.lua:8-13 - Creates a malformed long-string delimiter by appending the separator to an opening bracket, intentionally omitting the closing bracket.
CVE-2025-46819.lua:15-18 - Feeds the malformed string to loadstring, which triggers the vulnerable lexer code in Redis, causing an out-of-bounds read and typically crashing the server.
CVE-2025-46819.lua:20CVE-2025-46819.lua:22-23
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThe Lua script and README describe and implement a proof-of-concept for a known Redis vulnerability, consistent with the associated CVE description.
CVE-2025-46819.lua:1-25README.md:1-31
What the analysis did not establish
- The evidence does not include the execution output or confirmation that the exploit was successfully run against a live target.
- Only the two text files (payload withheld.lua and README.md) were reviewed; no binary files were present or analyzed.
- The review does not assess whether the PoC reliably triggers the vulnerability or is safe to execute in a controlled environment.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubdwisiswant0/CVE-2025-46818
Repository PoCStars: 0Created 2025-10-07ScannerCVE-2025-468182 files
Analysis
Technical assessment
The artifact is a Lua script and README that checks for the presence of deprecated Lua APIs (getfenv, setfenv, newproxy) and attempts to modify the string metatable to inject a helper method. It reports on the availability of these APIs and the success of the metatable modification, functioning as a vulnerability scanner rather than a full exploit.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept Lua script and README for CVE-2025-46818. The script demonstrates the claimed vulnerability by checking for deprecated Lua APIs and modifying the string metatable to inject an 'escalate' method that calls redis.pcall('ACL', 'WHOAMI'). This behavior is consistent with the described Redis sandbox escape and does not exhibit any concealed backdoor, credential theft, persistence, or unrelated payload. The script's actions are fully disclosed in the accompanying README.
Classification basis and observed behavior
Classification basis
The Lua script primarily checks for the presence of vulnerable conditions (deprecated APIs, mutable metatables) and reports on them. It does not autonomously exploit the vulnerability to achieve code execution in another user's context; it only injects a helper and requires a separate, manual step to invoke it. The README describes it as a 'repro' and verification script, consistent with a scanner.
CVE-2025-46818.lua:1CVE-2025-46818.lua:6-8README.md:17Requirements
- Authenticated access to a Redis instance with Lua scripting enabled.
README.md:2 - Redis version vulnerable to CVE-2025-46818 (e.g., 8.2.1).
README.md:11
Observed behavior
- Checks if deprecated Lua functions getfenv, setfenv, and newproxy are available.
CVE-2025-46818.lua:6-8 - Attempts to modify the string metatable to inject an 'escalate' method that calls redis.pcall('ACL', 'WHOAMI').
CVE-2025-46818.lua:19-31 - Returns a report indicating the availability of deprecated APIs and whether the metatable was patched.
CVE-2025-46818.lua:10-14CVE-2025-46818.lua:39
Behaviors behind the backdoor verdict
Observables
- Lua Script Behavior
- Payload withheldDemonstrates the claimed vulnerability by injecting a method that executes a privileged Redis command, matching the CVE description of running code in another user's context.
CVE-2025-46818.lua:24-31 - Deprecated Api Check
- Payload withheldVerifies the presence of deprecated Lua APIs that are part of the vulnerability, as described in the CVE and README.
CVE-2025-46818.lua:6-8
What the analysis did not establish
- The evidence does not include execution output or confirmation that the script successfully ran against a live Redis instance.
- The script's metatable injection is a partial step; full exploitation requires a separate privileged script execution, which is not automated in the provided code.
- Only the two text files (CVE-2025-46818.lua and README.md) were provided and reviewed; no other files exist in the repository snapshot.
- The review does not assess whether the PoC actually works as claimed or is safe to execute in any environment.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubdwisiswant0/CVE-2025-46817
Repository PoCStars: 2Created 2025-10-07ExploitCVE-2025-468172 files
Analysis
Technical assessment
A Lua script that triggers an integer overflow in Redis's unpack function by passing extreme start/end indices, causing the server to hang, exhaust memory, or crash, and potentially leading to remote code execution.
Backdoor review
No backdoor observed in reviewed code
The artifact contains a Lua script and a README that demonstrate a proof-of-concept for CVE-2025-46817, an integer overflow in Redis's Lua unpack function. The script calls unpack with extreme bounds to trigger a server crash or hang. No backdoor, deceptive payload, or concealed operator-directed harm is present; the behavior is consistent with the stated CVE demonstration.
Classification basis and observed behavior
Classification basis
The Lua script is designed to exercise the vulnerability by triggering the integer overflow with crafted arguments, causing a crash or memory corruption, which is the definition of an exploit. The README explicitly labels it as a PoC causing stack blow-up and crash, and describes potential RCE.
CVE-2025-46817.lua:1-10README.md:3README.md:7Requirements
- Authenticated access to a vulnerable Redis instance (version <= 8.2.1) with Lua scripting enabled.
CVE-2025-46817.lua:2README.md:7
Observed behavior
- Calls unpack with start index -2147483648 and end index 2147483647 to overflow signed arithmetic in luaB_unpack, bypassing stack size checks and causing the server to attempt to materialize billions of return values, leading to hang, memory exhaustion, or crash.
CVE-2025-46817.lua:6-10 - The README states that on vulnerable versions the server terminates the connection or crashes from excessive stack growth, and that combined with table index wrapping this can corrupt heap memory and lead to RCE.
README.md:7README.md:27
Behaviors behind the backdoor verdict
Observables
- Lua Script
- Payload withheldThe Lua script calls unpack with bounds designed to overflow signed arithmetic, matching the described CVE-2025-46817 vulnerability.
CVE-2025-46817.lua:10 - Command
- Payload withheldThe README instructs the user to run the Lua script against a local Redis instance, which is the standard method for testing a Redis Lua exploit.
README.md:22
What the analysis did not establish
- The evidence consists only of the Lua script and README; no network captures, server logs, or execution output are provided to confirm the described behavior.
- The README's claim of potential RCE via heap corruption is not demonstrated in the supplied code, which only triggers the overflow and crash.
- Only the two text files (CVE-2025-46817.lua and README.md) were reviewed; no binary files were present or inspected.
- The review does not assess whether the PoC actually triggers the vulnerability or is safe to execute in a controlled environment.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.