CVE-2018-11218
CRITICALRedis < 3.2.12, 4.x < 4.0.10, 5.x < 5.0 RC2 - Memory Corruption via Lua cmsgpack Library
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2018-11218.
Includes Metasploit module exploits/linux/redis/redis_replication_cmd_exec.
AI-analyzed exploit summary This Metasploit module exploits Redis replication functionality to achieve remote code execution by leveraging the module loading feature in Redis 4.x and 5.x. It sets up a rogue Redis server to deliver a malicious module payload to a vulnerable Redis instance.
Description
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.
Exploits (1)
This Metasploit module exploits Redis replication functionality to achieve remote code execution by leveraging the module loading feature in Redis 4.x and 5.x. It sets up a rogue Redis server to deliver a malicious module payload to a vulnerable Redis instance.
References (13)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H