What is redis-poc?

This repository contains proof-of-concept exploits that demonstrate remote code execution vulnerabilities in several versions of Redis, a popular in-memory data store. The exploits work against Redis versions 6.2.22, 7.4.9, 8.6.4, 8.8.0, and 8.8.1, including some cases where they bypass existing security patches. The tools are intended for authorized security testing only. Each exploit targets a specific memory corruption bug. For versions 7.4.9 through 8.6.4, the attack exploits a flaw in how Redis handles stream consumer groups, causing a double free condition. The 8.8.0 exploit abuses a heap overflow in a bundled data processing module called RedisBloom. The 8.8.1 exploit targets another RedisBloom module bug involving improper memory deallocation. The author notes that some of these bypass incomplete fixes for previously disclosed vulnerabilities. Running the exploits requires Python 3.6 or newer and a C compiler. A helper library for computing Redis-compatible checksums must be built once. After that, each exploit script takes a target host, port, optional password, and an optional shell command to execute upon success. If no command is supplied, the exploit writes a proof file to the target's data directory by default. The repository includes calibration scripts for non-standard Redis builds, since memory layout offsets differ across compiled binaries. The README documents reliability statistics from the author's own testing on fresh containerized instances. Success rates range from five out of five to twenty-five out of twenty-five attempts depending on the version. The exploits for 8.8.0 and 8.8.1 are described as layout-sensitive, meaning they depend on the target's memory allocator state and work best against a fresh instance with no other activity. Failed attempts abort without crashing the server. The documentation also notes that some exploits leave deliberate residue on the target, such as corrupted internal keys and zeroed data structures, to keep freed memory chunks from being reclaimed. The repository states these leftovers are inert but advises against flushing or saving the target database afterward.