Comment by illliillll
4 days ago
This is a deeply uninteresting example for anyone clueful. It’s an authenticated RCE in redis, anyone even vaguely familiar with the codebase knows to not expect there to be any real security boundary in place here.
Don’t confuse this with an unauthenticated RCE, that would actually matter. Absolutely anyone can shit out endless bugs like this with AFL, this is an extremely messy unhardened surface that expects trusted inputs.
Yup. Getting pretty tired from seeing these "0days" that are not exploitable in any real use case. Just vibes, no substance.
Tired seeing them is one thing the real problem is tired updating your software stack with a frequency the team & tooling was never designed to sustain. Worse: You are not tired enough to forget the real security issues that would need some calm period to fix.
Sad side of this is that decision makers are seeing these and think that AI can replace yet another department in their office.
I just saw a nice presentation from SecFest from a guy who ran a red team, but now they pivoted to basically anything and will be more than happy to fix your car if that would pay their bills.
Sorry but this is simply delusional. We're in an era where creds can be bought in online markets, and redis open source has no default requirement for password complexity.
If you can 'shit out endless bugs like this with AFL' then maybe redis isn't fit for purpose. But I think it more likely that it just needs hardening and an end to these laissez faire attitudes.
Maybe share with us one good reason to not treat redis credentials like SSH credentials?
> and redis open source has no default requirement for password complexity.
Loudly Crying Face Emoji
You mean, like uncontrolled keys that can be used from anywhere and have no lifecycle care? Well at least SSH keys can't be guessed.
Redis suffers from security gatekeeping, where essential features are kept in the paid Enterprise fork, and community security efforts are blocked. So you can use x.509 mutual TLS certificate auth, but the setup is entirely manual. Which means you use long lived certificates, which is worse than hard passwords.
It needs short lived certificates and pinning against endpoints, and logging of endpoints against queries, and logging auth events/origins to the SIEM. If you have that setup then post-auth compromise is more manageable.
2 replies →