Redis embeds a Lua interpreter and runs scripts server-side through the EVAL family of commands. A script can call back into Redis with redis.call(), loop over keys, transform values, and return arbitrary results, all atomically on the server. When an attacker controls a script body, or the arguments passed to one, that scripting engine becomes an injection surface inside the database.
Scripts reach the server three ways: EVAL runs a script supplied inline, SCRIPT LOAD caches a script and returns its SHA1 digest, and EVALSHA runs a previously cached script by that digest. The three are linked: a script loaded once with SCRIPT LOAD can be re-run cheaply by SHA1, and an attacker who can load a script can later invoke it. This subtree covers each command as an injection vector.
Pages#
- EVAL: EVAL runs a Lua script inside Redis; injecting into the script body or its arguments lets an attacker drive redis.call() and reach every key server-side.
- EVALSHA: EVALSHA executes a Lua script already cached in Redis by its SHA1 digest, letting an attacker re-invoke a script they loaded or one already present in the ca...
- SCRIPT LOAD: SCRIPT LOAD compiles and caches a Lua script without running it and returns its SHA1, seeding the cache for a later EVALSHA in a load-then-exec workflow.
Tools#
- redis-cli: issue EVAL, SCRIPT LOAD, and EVALSHA against the server.
- Gopherus: smuggle scripting commands over an SSRF RESP connection.
- Burp Suite: intercept and tamper with Redis-backed web requests.