CVE-2025-48493: Yii2-redis Password Disclosure Vulnerability

CVE-2025-48493 Overview

CVE-2025-48493 affects the Yii 2 Redis extension, which provides Redis key-value store support for the Yii framework 2.0. When a Redis connection fails, the extension writes the command sequence to logs. In versions prior to 2.0.20, the AUTH command parameters are recorded in plain text, exposing the Redis username and password to anyone with read access to the application logs. The issue is tracked under [CWE-532: Insertion of Sensitive Information into Log File]. Version 2.0.20 fixes the issue by redacting AUTH arguments before they are passed to the exception message.

Critical Impact
Attackers with access to application or exception logs can recover Redis credentials in cleartext and pivot to the backing Redis instance.

Affected Products

yiisoft/yii2-redis versions prior to 2.0.20
Yii framework 2.0 applications using the Redis extension for cache, session, or queue backends
Deployments where log files are accessible to lower-privileged users or shipped to shared logging platforms

Discovery Timeline

2025-06-05 - CVE-2025-48493 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48493

Vulnerability Analysis

The yii2-redis extension communicates with Redis using the RESP protocol and buffers each outbound command. When the underlying socket write or read fails, the extension raises a SocketException and embeds the recent command sequence in the exception message for troubleshooting. That sequence includes the AUTH <username> <password> command sent during connection setup. The exception is then written to Yii's log targets, which commonly include file-based logs, database logs, or forwarded log streams. Any actor able to read those log destinations obtains valid Redis credentials without needing to intercept live traffic.

Root Cause

The root cause is missing sanitization of sensitive protocol data before serializing it into an error message. The extension treated the command trace as opaque diagnostic text and did not distinguish AUTH parameters from other command arguments. Combined with Yii's default behavior of persisting exception details, credentials became a durable artifact on disk.

Attack Vector

Exploitation is passive and requires prior access to log storage. An attacker who reads a log file, queries a centralized log index, or exfiltrates a backup can search for AUTH strings and extract the associated username and password. Those credentials then grant direct access to the Redis instance, which frequently holds session tokens, cache entries, and queued jobs.

php

// Patch applied in src/SocketException.php
class SocketException extends Exception
{
    public function __construct($message = null, $code = 0, \Exception $previous = null)
    {
        if (!YII_DEBUG) {
            $message = preg_replace('~AUTH \S+ \S+~', 'AUTH *** ***', $message);
        }
        parent::__construct($message, $code, $previous);
    }
}

Source: yii2-redis commit 962252d. The fix replaces the two arguments after AUTH with *** when YII_DEBUG is disabled, preventing credentials from being persisted in production logs.

Detection Methods for CVE-2025-48493

Indicators of Compromise

Log entries containing the pattern AUTH <username> <password> produced by yii\redis\SocketException
Unexpected Redis authentication events originating from IP addresses outside the application tier
Historical exception logs, log archives, or backups that include unredacted Redis command traces

Detection Strategies

Grep application logs, SIEM indexes, and archived log bundles for the regular expression AUTH \S+ \S+ to identify exposure and inventory affected hosts
Compare deployed yii2-redis package versions against 2.0.20 using dependency manifests such as composer.lock
Correlate Redis AUTH command activity with expected application source addresses to spot credential reuse from unauthorized locations

Monitoring Recommendations

Enable Redis ACL LOG and forward authentication failures and successes to a centralized log platform
Alert on new readers of directories that store Yii runtime logs, including operators and CI/CD service accounts
Track access to log aggregation systems and object storage buckets that receive shipped application logs

How to Mitigate CVE-2025-48493

Immediate Actions Required

Upgrade yiisoft/yii2-redis to version 2.0.20 or later using composer require yiisoft/yii2-redis:^2.0.20
Rotate every Redis username and password used by applications that ran a vulnerable version, and invalidate any sessions or tokens cached in Redis
Purge historical logs, log archives, and backups that contain unredacted AUTH lines, or restrict read access to a dedicated incident response role

Patch Information

The fix is delivered in yii2-redis version 2.0.20. The patch, published in commit 962252d2c57c187181e67bb66da3f27b4698358d, redacts AUTH arguments inside SocketException::__construct whenever YII_DEBUG is false. Additional context is available in the GitHub Security Advisory GHSA-g3p6-82vc-43jh.

Workarounds

Set YII_DEBUG to false in production and apply a custom log filter that strips AUTH \S+ \S+ from exception messages before they are written
Restrict filesystem permissions on runtime/logs and equivalent directories so that only the application user can read exception output
Bind Redis to the loopback interface or a private network segment and enforce network-level ACLs so exposed credentials cannot be replayed remotely

bash

# Upgrade the vulnerable extension and verify the installed version
composer require yiisoft/yii2-redis:^2.0.20
composer show yiisoft/yii2-redis | grep versions

# Search existing logs for exposed AUTH credentials before purging
grep -RIn --include='*.log' -E 'AUTH [^ ]+ [^ ]+' /var/www/app/runtime/logs