Redis默认密码漏洞安全隐患曝光（redis默认密码漏洞）

### Redis default password vulnerability: security hidden danger exposed

Redis is a key-value database, widely used in distributed systems and microservices.Recently, a security researcher has discovered the Redis default password vulnerability.It is a dangerous and severe vulnerability, which threatens hundreds of millions of Redis-powered applications around the world.The vulnerability exists in the way Redis stores its authentication information and allows an authenticated user to reset root passwords and gn complete access to the database.

The basic cause of this vulnerability is an authentication bug in Redis. By default, when a user installs Redis, the default password for the root user is blank:

requirepass ""

This configuration is the same as `noauth`. Even if you change the password to some other non-null and non-blank value, the vulnerability still exists. In this way, even without providing valid credentials, anyone can gn full access to the Redis server.

Once compromised，the attacker has complete control over the Redis server and all the data in it. Attackers use this to steal important data from the server, such as session information, passwords, or any other sensitive data used by the application. In addition, attackers can also inject malicious code into the server and turn it into a “zombie” in a larger attack chn.

Fortunately, there is an easy fix for this vulnerability. Users must configure Redis to set a non-blank password as soon as possible to prevent any unauthorized access to the database. Additionally, users can test their Redis server security by running tools like RedisScan.

To sum up, the Redis default password vulnerability is a threat to the security of Online applications.So please pay attention to the security of Redis server and configure the password correctly. Only in this way can we prevent the attackers from accessing our valuable data and ensure the security of Redis server.

## 总结

Redis默认密码漏洞是一种严重的安全隐患，其造成的危害很大，它会威胁到全世界上数以亿计的基于Redis的应用。最终由于Redis不正确配置root密码，而导致这一安全漏洞的产生，因此提醒用户尽快配置一个非空字符串密码以防止无权限访问攻击。另外，可以使用RedisScan等工具来测试Redis服务器的安全性。