3 ms·
As wild as this sounds, redis should not exposed to the internet and this appears to be an authenticated RCE. This is similar to claiming that a PSQL query gran
by himata4113 3mo ago
As wild as this sounds, redis should not exposed to the internet and this appears to be an authenticated RCE. This is similar to claiming that a PSQL query grants code execution when its actually a feature.
These systems are typically not tested as aggressively against vulnerabilities of that nature since 10 times out of 10 you have to have access to these systems already.
Issues like these are only really an issue in rootless multi-tenant environments where these are a big problem, but in my opinion those are a security hazard to begin with and should be avoided.
There is a way more interesting telegram RCE that kimi k3 allegedly discovered.
- sigmoid10 3mo ago>There is a way more interesting telegram RCE that kimi k3 allegedly discovered. Telegram server or client? The client is open source, so I expect any reasonably capable model to find things there sooner or later. But the sever is closed source. Finding an RCE there would be wild for such a model, since it would have to solve a whole bunch of adjacent problems instead of just digesting tons of code.
- __s 3mo agoYep. For managed postgres our threat model is to assume vm is compromised. It's paid off, just earlier this year there was RCE fix in PG 18.4
- yencabulator 3mo ago> This is similar to claiming that a PSQL query grants code execution when its actually a feature. Why do you claim that remote code execution is a feature of Postgres? That'd be just as much an RCE in Postgres as it is in Redis. This RCE bug in Redis e.g. made it possible to avoid any within-tenant access control. Don't diminish its importance.