Unauthenticated_Redis

🗄️ Unauthenticated Redis Access

📌 Description

Redis is an open-source in-memory data structure store. If not correctly configured, it may be exposed on Port 6379 without a password, allowing anyone to read the database, modify keys, or even gain code execution in some cases.

🔍 How to Test

1. Connect via redis-cli: redis-cli -h <IP>
2. Test access: info
3. List keys: keys *
4. Get value: get <key>

🛠️ Mitigations

1. Require Password: Set requirepass in redis.conf.
2. Bind to Loopback: Ensure Redis only listens on 127.0.0.1.
3. Change Port: Use a non-standard port.

🏷️ Related Machines

• 🏁 Redeemer