Redis

Redis RCE

If you haven't already, time to patch Redis. Otherwise, please setup authentication in front of your Redis instance. This remote code execution is going to get nasty http

John W8MEJ Menerick June 14, 2015 1-minute read Updated August 18, 2026

Key takeaways

Exposing unauthenticated in-memory databases to the internet is handing out root shells.
Writable configuration commands like `CONFIG SET dir` turn key-value stores into arbitrary file writers.
Never rely on default unauthenticated binds for backend data stores.

If you haven’t already, time to patch Redis. Otherwise, please setup authentication in front of your Redis instance.

This remote code execution is going to get nasty http://www.shodanhq.com/search?q=redis_version and https://benmmurphy.github.io/blog/2015/06/04/redis-eval-lua-sandbox-escape/ . Time to bring up a few honeypots to grab some decent exploits and related kits.

About the author

John W8MEJ Menerick

Explore cutting-edge cybersecurity insights and protective strategies with John Menerick. Deep dives, threat analysis, and live streams from securesql.info.

Research Speaking About

Related reading

Autonomous Incident Response at Scale: How Energy-Based Models & TAME Replace LLM Guessing in Security

Security Theater and Cap Tables: Deconstructing Cal.com's Closed-Source Pivot

Episode 2: The Layer 2 Bridge Lab