3 ms·
most people use redis on localhost (i hope)
by jijji 1y ago
most people use redis on localhost (i hope)
- johnbellone 1y agoI’d imagine recent uptick in using services like Upstash may make it harder for people to know if they are vulnerable or not. Is this mitigated by disabling Lua script execution?
- arnorhs 1y agoI would guess it is. Also: > Exploitation of this vulnerability requires an attacker to first gain authenticated access to your Redis instance.
- loloquwowndueo 1y agoUpstash wouldn’t be vulnerable - Upstash doesn’t run upstream redis, it’s a protocol-compatible proprietary implementation.
- benmmurphy 1y agoit used to possible to execute redis commands against localhost from the web browser using domain rebinding. but i think redis did something to the protocol to fix this. also, this is only really relevant for developers.
- styluss 1y ago52,874 are connected to the internet according to Shodan.https://www.shodan.io/search?query=redis+product%3A%22Redis+key-value+store%22 https://www.shodan.io/search?query=redis+product%3A%22Redis+... Not affiliated with them.