1. Summary

Recently, HUAWEI CLOUD noticed security personnel disclosing that a new remote command execution vulnerability exists in the Redis. Attackers can exploit this vulnerability to execute arbitrary code and remotely control the target server when the Redis is not authorized. After Reids 4.x, the Redis adds the module function. Through external expansion, a new Redis command can be implemented in the Redis to compile and load malicious .so files by writing the C language to achieve code execution.

For details, see the following link: https://paper.seebug.org/975/

Use analysis: https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf

2. Threat Level

Severity: important

(Severity: low, moderate, important, and critical)

3. Scope Of Impact

The vulnerability affects the following product versions:

Redis 2.x, 3.x, 4.x, and 5.x

4. Disposal Programme

Currently, no patch is released for Redis. The temporary solution is as follows:

1. Forbid external access to the Redis service port.

2. Do not start the Redis service as the root user.

3. Configure a security group to restrict the IP addresses that can be connected to the Redis server.

It is recommended that the information system operator who uses the Redis database perform self-check. If a vulnerability exists, rectify the fault based on the temporary solution.

Note: Before fixing vulnerabilities, back up your files and conduct a thorough test.