問(wèn)題報(bào)告:http://drops.wooyun.org/papers/3062
問(wèn)題分析:Redis 安全模型的觀念是: “請(qǐng)不要將Redis暴露在公開(kāi)網(wǎng)絡(luò)中, 因?yàn)樽尣皇苄湃蔚目蛻艚佑|到Redis是非常危險(xiǎn)的” 。The Redis security model is: “it’s totally insecure to let untrusted clients access the system, please protect it from the outside world yourself”. 因此最近爆出的問(wèn)題也非redis本身產(chǎn)品問(wèn)題,屬于不當(dāng)配置。
問(wèn)題規(guī)避: