Redis 2.8.0-6.2.18 - Authenticated Remote Code Execution via HyperLogLog String Parsing
Title source: llmExploitation Summary
EIP tracks 5 public exploits for CVE-2025-32023. PoCs published by Beatriz Fresno Naumova, leesh3288, manus-use.
AI-analyzed exploit summary This exploit targets a vulnerability in Redis (CVE-2025-32023) by crafting a malformed HyperLogLog (HLL) payload to trigger an integer overflow during a merge operation, potentially leading to remote code execution (RCE). The PoC connects to Redis, writes the malformed HLL, and triggers the overflow via pfcount.
Description
Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
Exploits (5)
This exploit targets a vulnerability in Redis (CVE-2025-32023) by crafting a malformed HyperLogLog (HLL) payload to trigger an integer overflow during a merge operation, potentially leading to remote code execution (RCE). The PoC connects to Redis, writes the malformed HLL, and triggers the overflow via pfcount.
This repository contains a working exploit for CVE-2025-32023, a vulnerability in Redis's HyperLogLog implementation that allows out-of-bounds writes due to integer overflow. The exploit achieves RCE by corrupting heap structures and leveraging Redis modules.
This repository contains functional exploit code for CVE-2025-32433, an Erlang OTP SSH vulnerability, demonstrating pre-authentication command execution via crafted SSH packets. The PoC includes a Dockerized vulnerable environment and a Python script to trigger the exploit.
The repository provides a detailed writeup for CVE-2025-32023, a remote code execution vulnerability in Redis affecting HyperLogLog operations due to an integer overflow. It includes technical details, mitigation steps, and references but lacks actual exploit code.
This repository contains a working exploit for CVE-2025-32023, a critical RCE vulnerability in Redis versions below 7.2.4. The exploit leverages a malformed HyperLogLog (HLL) structure to achieve arbitrary memory corruption and ROP chain execution, leading to remote code execution.
References (7)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H