Elastic critical stable eql

Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell)

This rule detects exploitation attempts targeting CVE-2025-49844 (RediShell), a CVSS 10.0 use-after-free vulnerability in the Redis Lua interpreter. An authenticated attacker sends an EVAL command containing a Lua script that calls string.rep() to create memory pressure and collectgarbage('collect') to force garbage collection, exploiting a use-after-free in the Lua parser to achieve remote code execution.

View Source

Detection Logic

network where data_stream.dataset == "network_traffic.redis" and
  network_traffic.redis.query like~ "*EVAL*" and
  network_traffic.redis.query like~ "*string.rep*" and
  network_traffic.redis.query like~ "*collectgarbage*"

Field Validations

Loading…

Comments (0)

Loading comments...