CVE-2024-46981
HIGHRedis 6.2.0-6.2.16 - Authenticated Remote Code Execution via Lua Script Garbage Collector Manipulation
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-46981. PoCs published by publicqi, xsshk.
AI-analyzed exploit summary This is a functional exploit for CVE-2024-46981 targeting Redis 6.2.11, leveraging a use-after-free vulnerability in Lua scripting to achieve remote code execution via heap manipulation and forged objects.
Description
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
Exploits (2)
This is a functional exploit for CVE-2024-46981 targeting Redis 6.2.11, leveraging a use-after-free vulnerability in Lua scripting to achieve remote code execution via heap manipulation and forged objects.
This is a functional exploit for CVE-2024-46981 targeting Redis 6.2.11, leveraging a use-after-free vulnerability in Lua scripting to achieve remote code execution via heap manipulation and forged objects.
References (7)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H