Redis < 6.2.20 / 7.0.x < 7.2.11 / 7.4.x < 7.4.6 / 8.0.x < 8.0.4 / 8.2.x < 8.2.2 RCE (RediShell)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(339370);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_cve_id("CVE-2025-49844");

  script_name(english:"Redis < 6.2.20 / 7.0.x < 7.2.11 / 7.4.x < 7.4.6 / 8.0.x < 8.0.4 / 8.2.x < 8.2.2 RCE (RediShell)");

  script_set_attribute(attribute:"synopsis", value:
"A database server running on the remote host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Redis installed on the remote host is prior to 6.2.20, 7.0.x prior to 7.2.11, 7.4.x prior to
7.4.6, 8.0.x prior to 8.0.4, or 8.2.x prior to 8.2.2. It is, therefore, affected by a vulnerability as referenced in
the security advisory.

  - A use-after-free vulnerability in the Lua scripting engine. An authenticated user can use a specially
    crafted Lua script to manipulate the garbage collector, trigger a use-after-free, and potentially achieve
    remote code execution. (CVE-2025-49844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6002afb9");
  script_set_attribute(attribute:"see_also", value:"https://redis.io/blog/security-advisory-cve-2025-49844/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Redis version 6.2.20 / 7.2.11 / 7.4.6 / 8.0.4 / 8.2.2 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-49844");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(416);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/25");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:redis:redis");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("redis_detect.nbin", "redis_ltd_redis_nix_installed.nbin");
  script_require_keys("installed_sw/Redis Server");

  exit(0);
}

include('vdf.inc');

# The feeding detections report a plain numeric version only. A patched Redis Stack build and a
# vulnerable Redis OSS/CE release on the same engine line are therefore indistinguishable here, so
# reporting is limited to paranoid scans until the detections report the edition and full build.
# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'Redis Server', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        { 'min_version' : '0.0.0', 'fixed_version' : '6.2.20' },
        { 'min_version' : '7.0.0', 'fixed_version' : '7.2.11' },
        { 'min_version' : '7.4.0', 'fixed_version' : '7.4.6' },
        { 'min_version' : '8.0.0', 'fixed_version' : '8.0.4' },
        { 'min_version' : '8.2.0', 'fixed_version' : '8.2.2' }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE, check_backporting:TRUE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);