Redis < 7.2.14 / 7.4.x < 7.4.9 / 8.2.x < 8.2.6 / 8.4.x < 8.4.3 / 8.6.x < 8.6.3 / 8.8.x < 8.8-RC1 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(372453);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/28");

  script_cve_id(
    "CVE-2026-23479",
    "CVE-2026-23631",
    "CVE-2026-25243",
    "CVE-2026-25588",
    "CVE-2026-25589"
  );
  script_xref(name:"IAVA", value:"2026-A-0426");

  script_name(english:"Redis < 7.2.14 / 7.4.x < 7.4.9 / 8.2.x < 8.2.6 / 8.4.x < 8.4.3 / 8.6.x < 8.6.3 / 8.8.x < 8.8-RC1 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A database server running on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Redis installed on the remote host is prior to 7.2.14, or 7.4.x prior to 7.4.9, or 8.2.x prior to 8.2.6,
or 8.4.x prior to 8.4.3, or 8.6.x prior to 8.6.3, or 8.8.x prior to 8.8-RC1. It is, therefore, affected by multiple
vulnerabilities:

  - A use-after-free vulnerability exists in unblock client flow due to improper handling of an error return
    from `processCommandAndResetClient`. An authenticated, remote attacker can exploit this to execute
    arbitrary code. (CVE-2026-23479)

  - A use-after-free vulnerability exists in the master-replica synchronization mechanism. An authenticated,
    remote attacker can exploit this to execute arbitrary code. (CVE-2026-23631)

  - A remote code execution vulnerability exists in the RESTORE command due to improper validation of
    serialized values. An authenticated, remote attacker can exploit this to bypass authentication and execute
    arbitrary commands. (CVE-2026-25243, CVE-2026-25588, CVE-2026-25589) 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://raw.githubusercontent.com/redis/redis/7.2/00-RELEASENOTES");
  script_set_attribute(attribute:"see_also", value:"https://raw.githubusercontent.com/redis/redis/7.4/00-RELEASENOTES");
  script_set_attribute(attribute:"see_also", value:"https://raw.githubusercontent.com/redis/redis/8.2/00-RELEASENOTES");
  script_set_attribute(attribute:"see_also", value:"https://raw.githubusercontent.com/redis/redis/8.4/00-RELEASENOTES");
  script_set_attribute(attribute:"see_also", value:"https://raw.githubusercontent.com/redis/redis/8.6/00-RELEASENOTES");
  script_set_attribute(attribute:"see_also", value:"https://raw.githubusercontent.com/redis/redis/8.8/00-RELEASENOTES");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Redis version 7.2.14, 7.4.9, 8.2.6, 8.4.3, 8.6.3, 8.8-RC1 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-25589");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(20, 122, 416);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/27");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:redis:redis");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("redis_detect.nbin", "redis_ltd_redis_nix_installed.nbin");
  script_require_keys("installed_sw/Redis Server", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'Redis Server', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {
          'fixed_version': '7.2.14',
          'report': {'cves': ['CVE-2026-23479', 'CVE-2026-23631', 'CVE-2026-25243']}
        },
        {
          'min_version': '7.3', 'fixed_version': '7.4.9',
          'report': {'cves': ['CVE-2026-23479', 'CVE-2026-23631', 'CVE-2026-25243']}
        },
        {'min_version': '8.1', 'fixed_version': '8.2.6'},
        {'min_version': '8.3', 'fixed_version': '8.4.3'},
        {'min_version': '8.5', 'fixed_version': '8.6.3'},
        {'min_version': '8.7', 'fixed_version': '8.7.240', 'fixed_display': '8.8-RC1'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);