Redis Unauthorized Access Vulnerability
Description
Redis is an open-source in-memory data structure store commonly used for caching, session management, and real-time analytics.
This vulnerability occurs when a Redis instance is accessible without authentication from untrusted networks or the public internet. Redis is designed to operate within trusted environments and lacks authentication by default in older configurations, making exposed instances vulnerable to unauthorized access and exploitation.
Remediation
Implement the following security controls to protect the Redis instance:
1. Bind to localhost only: Configure Redis to listen only on trusted interfaces by setting bind 127.0.0.1 ::1 in redis.conf
2. Enable authentication: Set a strong password using the requirepass directive:
requirepass your_strong_password_here
3. Use firewall rules: Restrict access to Redis port (default 6379) using iptables or cloud security groups to allow only trusted IP addresses
4. Disable dangerous commands: Rename or disable commands like FLUSHDB, FLUSHALL, CONFIG, and EVAL:
rename-command CONFIG "" rename-command FLUSHALL ""
5. Enable protected mode: Ensure
protected-mode yes is set in redis.conf (default in Redis 3.2+)6. Use TLS encryption: For Redis 6.0+, enable TLS to encrypt data in transit between clients and the server