On October 3, 2025, Redis disclosed CVE-2025-49844, a critical Lua sandbox escape vulnerability that allows authenticated attackers to execute arbitrary code on the host. With a CVSS score of 9.9, the flaw affects all Redis versions prior to 8.2.2, 7.4.6, and 7.2.11. Within days, CISA added it to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. This article breaks down the technical mechanics, attacker TTPs, and provides actionable detection and mitigation guidance for security teams.
Background: The Redis Lua Sandbox Escape
Redis has long supported server-side Lua scripting via the EVAL command, enabling atomic execution of complex operations. To prevent scripts from compromising the host, Redis implements a sandbox that restricts access to system calls, file I/O, and other sensitive operations. CVE-2025-49844 bypasses this sandbox through a use-after-free (UAF) vulnerability in the Lua interpreter's garbage collector, allowing an attacker to corrupt memory and achieve arbitrary code execution.
The vulnerability was discovered by security researcher Rico Rönkkönen of ZDI and reported to Redis. Redis released patches on October 3, 2025, in versions 8.2.2, 7.4.6, and 7.2.11. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting a network-exploitable flaw requiring low privileges (authenticated access) but leading to full host compromise.
"An authenticated user with permission to execute Lua scripts can exploit this vulnerability to execute arbitrary code on the Redis host." — Redis Security Advisory
The flaw is particularly dangerous because Redis is often deployed in trusted internal networks without authentication, or with weak/default credentials. Even when authentication is enabled, many organizations grant EVAL permissions broadly to application users.
Affected Versions and Exposure
According to the Redis advisory, the following versions are vulnerable:
- All Redis versions prior to 8.2.2
- All Redis versions prior to 7.4.6
- All Redis versions prior to 7.2.11
Redis 6.x and 5.x are also affected but are end-of-life and will not receive patches. Users are urged to upgrade to a supported version. The vulnerability affects both open-source Redis and Redis Enterprise. Cloud providers including AWS ElastiCache, Google Cloud Memorystore, and Azure Cache for Redis have issued patches; check their respective security bulletins for patch availability.
Exposure is significant: Redis is one of the most widely deployed in-memory data stores, used for caching, session management, message brokering, and real-time analytics. A Shodan search for exposed Redis instances typically returns hundreds of thousands of results, though many are behind firewalls. The true risk lies in internal deployments where Redis is reachable from compromised application servers or container environments.
Attacker TTPs and Exploitation Chain
Exploitation follows a predictable pattern. The attacker first gains authenticated access to Redis, either through default credentials, leaked credentials, or by exploiting an application that uses Redis as a backend. They then use the EVAL command to execute a malicious Lua script that triggers the UAF.
The UAF occurs in the Lua garbage collector when a specific sequence of table operations causes premature freeing of a TString object. By carefully grooming the heap, the attacker can reclaim the freed memory with controlled data, leading to arbitrary read/write primitives. From there, they bypass ASLR and execute shellcode.
Observed post-exploitation activities include:
- T1190: Exploit Public-Facing Application — Initial access via exposed Redis instances.
- T1059.004: Command and Scripting Interpreter: Unix Shell — Execution of reverse shell or cryptocurrency miner.
- T1053: Scheduled Task/Job — Persistence via cron jobs or systemd services.
- T1071.001: Application Layer Protocol: Web Protocols — C2 over HTTP/HTTPS to blend with normal traffic.
In at least one public incident report, attackers deployed a Monero miner and established SSH backdoors. The CISA KEV catalog entry confirms active exploitation as of October 10, 2025.
Detection: Sigma and YARA Rules
Detecting this exploitation requires monitoring both Redis command execution and host-level anomalies. The following Sigma rule detects suspicious Lua script execution patterns indicative of exploitation attempts.
title: Redis Lua Sandbox Escape Exploitation Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects EVAL commands with suspicious Lua patterns targeting CVE-2025-49844
references:
- https://github.com/redis/redis/security/advisories/GHSA-ghp8-52vx-77j4
author: CybernytronX
date: 2025-10-15
logsource:
product: redis
service: audit
detection:
selection:
event: COMMAND
command: EVAL
keywords:
- 'collectgarbage'
- 'string.dump'
- 'loadstring'
- 'setmetatable'
condition: selection and keywords
falsepositives:
- Legitimate administrative scripts using advanced Lua features
level: high
For host-based detection, the following YARA rule identifies common payloads dropped after successful exploitation.
rule CVE_2025_49844_PostExploit
{
meta:
description = "Detects artifacts from Redis Lua sandbox escape exploitation"
author = "CybernytronX"
date = "2025-10-15"
reference = "https://github.com/redis/redis/security/advisories/GHSA-ghp8-52vx-77j4"
strings:
$s1 = "/tmp/.xmr" ascii
$s2 = "stratum+tcp://" ascii
$s3 = "redis-server -c" ascii
condition:
any of them
}
Network detection can leverage Suricata to flag anomalous Redis traffic containing Lua script payloads.
alert tcp any any -> any 6379 (msg:"CVE-2025-49844 Redis Lua Exploit Attempt"; flow:to_server,established; content:"EVAL"; content:"collectgarbage"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)
Mitigation and Patching
Immediate action: upgrade to Redis 8.2.2, 7.4.6, or 7.2.11. For detailed instructions, refer to the Redis security advisory. If upgrading is not immediately possible, apply the following compensating controls:
- Disable Lua scripting entirely by renaming or removing the
EVALandEVALSHAcommands usingrename-commandin redis.conf. - Enforce strong authentication with ACLs. Restrict EVAL permissions to only trusted users.
- Network segmentation: ensure Redis is not exposed to the internet and is accessible only from trusted application servers.
- Enable Redis protected mode and bind to localhost or internal interfaces.
- Monitor for indicators of compromise using the detection rules above.
For Redis Enterprise, apply the patch provided by Redis Inc. Cloud providers have auto-patched managed services; verify your instance version in the provider console.
Why This Matters for Defenders
CVE-2025-49844 is a stark reminder that sandbox escapes in scripting engines remain a potent attack vector. Redis's Lua sandbox was designed to be secure, but memory safety bugs in the underlying interpreter can undermine it. Defenders must treat Redis as a high-value target, not just a cache. The combination of widespread deployment, frequent lack of authentication, and the ease of exploitation makes this vulnerability a favorite for initial access brokers and ransomware affiliates.
Moreover, the active exploitation within days of disclosure highlights the need for rapid patch cycles and robust detection. Organizations should inventory all Redis instances, including those embedded in applications or containers, and ensure they are patched or properly isolated. As Redis continues to evolve, security teams must keep pace with its expanding feature set and associated risks.
Sources
- Redis Security Advisory GHSA-ghp8-52vx-77j4 — Official advisory detailing the vulnerability, affected versions, and patch information.
- CISA Known Exploited Vulnerabilities Catalog — Confirms active exploitation of CVE-2025-49844.
- NVD Entry for CVE-2025-49844 — CVSS score, CWE classification, and reference links.
- ZDI Advisory ZDI-25-833 — Researcher credit and technical analysis of the sandbox escape.
Frequently Asked Questions
Is authentication required to exploit CVE-2025-49844?
Yes, the attacker must be able to execute Lua scripts, which typically requires authenticated access with EVAL permissions. However, many Redis deployments lack authentication or use default credentials, making exploitation trivial.
Can I disable Lua scripting as a workaround?
Yes, you can rename or disable the EVAL and EVALSHA commands in redis.conf using rename-command EVAL "". This prevents exploitation but may break applications relying on Lua scripts.
Are cloud-managed Redis services affected?
AWS ElastiCache, Azure Cache for Redis, and Google Cloud Memorystore have patched their services. Check your provider's security bulletin and ensure your instances are updated.
What are the indicators of compromise for this vulnerability?
Look for unexpected processes like cryptocurrency miners, outbound connections to mining pools, new SSH authorized keys, and unusual EVAL commands in Redis logs containing collectgarbage or string.dump.
How does this compare to previous Redis vulnerabilities?
Unlike CVE-2022-0543 (Lua sandbox escape on Debian), CVE-2025-49844 affects all platforms and is more reliably exploitable. It is also being actively exploited in the wild, raising its urgency.
Need expert help with this?
CybernytronX specializes in vulnerability assessment, penetration testing, and SOC build-out. Our team can help you identify exposed Redis instances, validate patch coverage, and implement detection rules tailored to your environment. We also offer Ethereon AI, our advanced threat detection platform that can flag exploitation attempts in real time. Contact us at cybernytronx.com/contact.html or learn more about Ethereon at cybernytronx.com/ethereon.html.