2 min read

Mitigation Instructions for Redis Server Unprotected by Password Authentication

Mitigation Instructions for Redis Server Unprotected by Password Authentication

Subject: Redis Server Unprotected by Password Authentication

Tech Stack: Redis

Date(s) Issued:

  • Published: 06/06/2017
  • Last Updated: 04/11/2022

Criticality:

  • Severity: Critical
  • Misconfiguration: Exposed Redis Server 
  • CVSS Score: Not explicitly provided, but categorized as "Critical."

Overview

The critical misconfiguration concerns a Redis server that is not protected by password authentication. Redis, an in-memory data structure store, is used as a database, cache, and message broker. The absence of password protection on the Redis server allows unauthorized remote attackers to gain full access to the server, potentially leading to data breaches, unauthorized data manipulation, or even full server compromise.

Affected Versions

All versions of Redis that do not have password authentication enabled via the requirepass directive in the redis.conf configuration file are vulnerable.

Potential Impact

A remote attacker exploiting this vulnerability can:

  • Gain unauthorized access to the Redis server.
  • Execute arbitrary commands.
  • Access, modify, or delete sensitive data.
  • Potentially escalate privileges within the network.

Solution/Mitigation

To mitigate this vulnerability, you need to secure the Redis server by enabling password authentication.

Step 1: Configure Password Authentication

  1. Edit the Redis Configuration File:

    • Locate the redis.conf file, typically found in /etc/redis/ or /etc/redis/redis.conf.
    • Open the file in a text editor with sufficient privileges (e.g., sudo nano /etc/redis/redis.conf).
  2. Enable Password Authentication:

    • Find the line that begins with # requirepass (it may be commented out with a #).
    • Uncomment the line and set a strong password:
      plaintext
       
      requirepass yourStrongPasswordHere
    • Replace yourStrongPasswordHere with a strong, unique password.
  3. Save and Close the File:

    • Save the changes to the redis.conf file and close the text editor.
  4. Restart the Redis Server:

    • Restart the Redis service to apply the changes:
      bash
       
      sudo systemctl restart redis
    • Alternatively, use the following command if using init.d:
      bash
       
      sudo service redis-server restart

Step 2: Verify the Mitigation

  • Check the Redis Server Configuration: Run the following command to confirm the password requirement is enabled:

    bash
     
    redis-cli CONFIG GET requirepass

    Ensure the output includes the strong password you set.

  • Test Authentication: Use the redis-cli to connect to the Redis server and verify that it prompts for a password:

    bash
     
    redis-cli
    AUTH yourStrongPasswordHere

    Ensure access is only granted after successful authentication.

Additional Measures

  • Firewall Configuration: Ensure the Redis server is not exposed directly to the internet. Restrict access to the Redis port (default 6379) using a firewall or a network security group.
  • Network Segmentation: Place the Redis server behind a VPN or on a private network segment that is inaccessible to unauthorized users.
  • Monitoring: Enable monitoring to detect any unauthorized access attempts or anomalies in server behavior.

Confirmation & Additional Information

  • Confirmation Steps: After implementing the changes, regularly monitor Redis server logs for unauthorized access attempts and validate configurations to ensure compliance.
  • Stay Updated: Regularly check for Redis updates and apply security patches as they become available.
  • Further Reading: Redis AUTH Command Documentation

By implementing these measures, you can significantly reduce the risk associated with the Redis server being unprotected by password authentication.

Mitigation Instructions for CVE-2024-28987

Mitigation Instructions for CVE-2024-28987

Subject: Mitigating CVE-2024-28987: Hardcoded Credentials Vulnerability in SolarWinds Web Help Desk

Read More
Mitigation Instructions for CVE-2017-1000486

Mitigation Instructions for CVE-2017-1000486

Subject: Mitigating CVE-2017-1000486: Remote Code Execution Vulnerability in PrimeTek PrimeFaces

Read More
Mitigation Instructions for Drupal SEoL (8.x)

Mitigation Instructions for Drupal SEoL (8.x)

Subject: Mitigating Vulnerability in Unsupported Drupal 8.x

Read More