CVE-2025-46817: The SOC Report on Hardening the Lua Engine Against Four Critical Vulnerabilities (Redis 8.2.2)

Analysis

Cybercriminals are sending spoofed email delivery notifications that look like internal spam filter alerts. The messages contain a malicious “Move to Inbox” button and an unsubscribe link that redirect through a compromised domain to a phishing site. The site uses heavily obfuscated code and a WebSocket channel to harvest credentials instantly, including possible 2FA codes.

Investigation

Researchers observed that the phishing emails embed a base64‑encoded email address in the redirect URL. Both the button and the unsubscribe link forward to cbs which then forwards to the final phishing host. The malicious page serves a fake login form pre‑filled with the victim’s domain and captures credentials via a persistent WebSocket connection, allowing real‑time exfiltration and prompting for additional data such as 2FA codes. Indicators of compromise include multiple subdomains of http://mdbgo.io and unrelated domains such as xxx-three-theta.vercel.app, client1.inftrimool.xyz, http://psee.io , veluntra-technology-productivity-boost-cold-pine-8f29.ellenplum9.workers.dev, lotusbridge.ru.com, and shain-log4rtf.surge.sh.

Mitigation

Verify sender addresses and inspect URLs before clicking. Use multi‑factor authentication on all accounts. Deploy up‑to‑date security software with web protection, such as Malwarebytes Browser Guard, to block malicious redirects. Employ password managers that do not auto‑fill credentials on unknown sites. Educate users to avoid unsolicited attachments and to confirm unexpected requests via an alternate channel. Regularly update operating systems and applications.

Response

Block the listed malicious domains and subdomains at the network perimeter and DNS level. Deploy web filtering solutions to detect and block redirects to known phishing hosts. Conduct credential reset campaigns for any accounts that may have been compromised. Monitor WebSocket traffic for unusual outbound connections. Perform user awareness training focused on spoofed email alerts and phishing techniques.

Simulation Instructions

• Attack Narrative & Commands:
  An attacker with network access to the Redis instance crafts a malicious Lua payload that calls luaX_setinput with an oversized string, causing an integer overflow inside the Lua engine. The payload is delivered via redis-cli --eval to the target key exploit. Execution of this payload forces Redis to load the Lua script, invoke the vulnerable function, and crash or execute arbitrary code, which is precisely what the detection rule watches for.

• Regression Test Script:

  #!/usr/bin/env bash
  # -------------------------------------------------
  # Exploit simulation: trigger luaX_setinput overflow
  # -------------------------------------------------
  set -euo pipefail
  
  REDIS_CLI="redis-cli"
  EXPLOIT_KEY="exploit"
  # Construct an oversized input string (> 2^31 bytes) – here we use a repeat to simulate size