imbas007/CVE-2025-49844-Vulnerability-Scanner

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based vulnerability scanner that checks Redis instances for exposure to CVE-2025-49844 by connecting, retrieving the server version, testing Lua scripting availability, and comparing the version against a hardcoded list of vulnerable releases. It does not execute or deliver any exploit payload.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python-based vulnerability scanner for CVE-2025-49844. The code performs Redis connection tests, version checks, and Lua scripting availability checks. No backdoor, trojan, or deceptive payload was observed. The scanner does not execute any exploit payload, establish persistence, exfiltrate data, or perform any action beyond the stated vulnerability assessment.

ClassificationScanner
Model confidence98%
AuthenticationRequired
LanguagesPython
Target softwareRedis
Attack typesvulnerability scanning
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary operation is to detect whether a Redis instance is vulnerable to CVE-2025-49844 by checking the server version and Lua scripting availability. It does not contain any code that triggers a use-after-free, manipulates the garbage collector, or achieves remote code execution. The README explicitly describes it as a 'Vulnerability Scanner' and the code only performs read-only diagnostic commands (PING, INFO, EVAL with a safe return statement).

CVE-2025-49844-Vulnerability-Scanner.py:2-5CVE-2025-49844-Vulnerability-Scanner.py:56-64README.md:1-3

Requirements

  • Network access to a Redis instance on a reachable IP:PORTCVE-2025-49844-Vulnerability-Scanner.py:38-45
  • Redis instance must accept unauthenticated connections or the scanner must supply valid credentials (the code does not implement authentication)CVE-2025-49844-Vulnerability-Scanner.py:41-42

Observed behavior

  • Connects to a Redis server and sends a PING command to verify accessibilityCVE-2025-49844-Vulnerability-Scanner.py:38-45
  • Retrieves the Redis server version via the INFO commandCVE-2025-49844-Vulnerability-Scanner.py:47-54
  • Executes a benign Lua script (return 'Lua scripting enabled') to test whether EVAL is permittedCVE-2025-49844-Vulnerability-Scanner.py:56-64
  • Compares the retrieved version against a hardcoded list of vulnerable version strings and a version-range logic to determine vulnerability statusCVE-2025-49844-Vulnerability-Scanner.py:66-105
  • Reports results to stdout with color-coded output and optionally saves vulnerable targets to a text file or full results to a JSON fileCVE-2025-49844-Vulnerability-Scanner.py:245-292
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Redis connections to user-supplied targetsThe scanner connects to Redis instances specified by the user via -t or -l arguments to check version and Lua scripting status.CVE-2025-49844-Vulnerability-Scanner.py:41-42CVE-2025-49844-Vulnerability-Scanner.py:50-51CVE-2025-49844-Vulnerability-Scanner.py:59-61
File Write
Output files vuln.txt and optional JSON resultsThe scanner writes scan results to local files as documented; no unexpected file writes or system modifications occur.CVE-2025-49844-Vulnerability-Scanner.py:273-274CVE-2025-49844-Vulnerability-Scanner.py:290-291
External Reference
README.md line 78: 'sorce: https://github.com/raminfp'A typo'd attribution link to a GitHub profile; no evidence of malicious content at the link, and the scanner does not fetch or execute it.README.md:78
Review boundaries

What the analysis did not establish

  • The scanner does not implement Redis authentication; it will fail against password-protected instances unless they are configured to accept unauthenticated connections.
  • Vulnerability determination relies solely on version string comparison and does not attempt to trigger the actual use-after-free condition, so false positives/negatives are possible if version detection fails or the server is patched outside the version scheme.
  • Only the three text files in the repository were reviewed; no binary or non-text files were present.
  • The review does not assess the safety of the linked GitHub profile or any content hosted there.
  • The scanner's version comparison logic may produce false positives or negatives, but this is a functional limitation, not a backdoor.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1