Redis Use-After-Free in Unblock Client Flow

Repository is a bundled collection of three Redis CVE-2026-23479 artifacts rather than a single cohesive project. Structure: (1) pduggusa-check/ contains a safe read-only Python version checker and a Sigma detection rule; it connects to Redis, optionally authenticates, sends INFO server, parses redis_version, and compares against fixed releases. (2) v1c0mmrt-scanner/ contains a Python scanner plus a separate exploit PoC; the scanner uses redis-py to assess version, authentication, ACL permissions, bind exposure, and mitigation settings such as renamed EVAL/CONFIG commands. (3) rizlmaulanaa-poc/ contains a more explicit exploit PoC in a single Python file intended for lab use with Docker and GDB. The exploit logic uses raw RESP over TCP to Redis, blocks a client with XREAD BLOCK on a stream, then unblocks it with XADD while a GDB breakpoint is placed on processCommandAndResetClient. In GDB proof mode it calls freeClient($rdi) to force a crash and demonstrate the UAF path; in RCE mode it invokes system() with an attacker-supplied shell command, verifying success via proof files such as /tmp/pwned. Overall capability spans safe detection, configuration/risk scanning, UAF crash proof, and arbitrary command execution in a controlled containerized lab. The exploit is operational rather than fully weaponized because RCE depends on hardcoded/local GDB-assisted container access rather than a standalone remote exploit chain.

This repository is a small standalone Redis exploit PoC consisting of a README and a single Python script, redisexp.py. The script is not part of a major exploit framework. Its purpose is to validate and demonstrate CVE-2026-23479, described as a use-after-free in Redis unblockClientOnKey()/processCommandAndResetClient handling. Structure and behavior: - README.md documents the vulnerability, affected versions, Docker lab setup, and four modes: crash, gdb, rce, and full. - redisexp.py implements a minimal Redis client over raw TCP sockets using RESP encoding, version detection via INFO server, liveness checks via PING, and exploit orchestration. - The exploit logic blocks a client with XREAD on a Redis stream, then unblocks it with XADD to force execution through the vulnerable code path. - In GDB-assisted mode, the script writes a batch GDB script to a temp file, copies it into the Docker container, attaches to redis-server as pid 1, sets a breakpoint on processCommandAndResetClient, and executes call (void)freeClient($rdi) to force a crash and prove the dangling-pointer path. - In RCE mode, per the README and visible code structure, it similarly uses GDB to invoke system() with a user-supplied command, then verifies success by checking for a proof file such as /tmp/pwned. - The script also includes a non-GDB crash mode based on memory pressure and a full mode that falls back from crash to GDB proof. Main exploit capabilities: - Fingerprints target Redis version and checks whether it falls in hardcoded vulnerable ranges. - Reaches the vulnerable blocked-client/unblock stream-processing path using XREAD/XADD. - Causes a controlled crash to demonstrate UAF impact. - Executes arbitrary shell commands inside the Redis container in RCE mode through GDB-assisted system() invocation. - Cleans up stale GDB sessions and supports configurable Docker container names. Operational notes: - This is an operational PoC rather than a weaponized exploit. The RCE path depends on privileged local/container access to run GDB against the Redis process, so it demonstrates exploitability rather than providing a pure remote unauthenticated RCE chain. - The code excerpt is truncated, but the README and visible implementation strongly indicate complete support for the documented modes and verification steps.