Unauthenticated Service: Redis

The application initializes a Redis client without setting any credentials.

Unauthenticated Redis servers may be targeted by attackers to get a foothold on your internal network by compromising the server.

Different attacks may be used against a Redis server to get arbitrary code execution on its underlying operating system. For example, an attacker may use Redis commands to write a web shell into the web root. When used to store objects, an attacker may also store deserialization payloads for different languages such as Java, Python, Ruby, PHP, etc. in order to get remote code execution on the deserializating endpoint.

Please note that even if the Redis server is not exposed externally, an external attacker may still reach it via a Server-Side Request Forgery vulnerability in any application on the same network. Redis Servers can be attacker using HTTP or Gopher protocols for example.

Failing to protect the Redis port from the outside can have a big security impact because of the nature of Redis. For instance, a single FLUSHALL command can be used by an external attacker to delete the whole data set. Recently, there have been reports of malicious attacks on unsecured instances of Redis running openly on the internet. The attacker erased the database and demanded a ransom be paid before restoring it.