STIGQter STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS and associated applications must reserve the use of dynamic code execution for situations that require it.

DISA Rule

SV-251250r961158_rule

Vulnerability Number

V-251250

Group Title

SRG-APP-000251-DB-000391

Rule Version

RD6X-00-011900

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Redis does not rely on a query language and there is no known method of SQL injection that would apply to Redis. Redis is a key value store and relies on commands that do not have a unified query language. Redis has an embedded LUA interpreter that is recommended to disable.

To disable the interpreter run the following REST API command:
curl -v -kL -u "<user>:<password>" --location-trusted -H "Content-type: application/json" -d '{ "disabled_commands": "EVAL, EVALSHA" }' -X PUT https://<URL>:PORT/v1/bdbs/<DB_ID>

Check Contents

Redis does not rely on a query language and there is no known method of SQL injection that would apply to Redis. Redis is a key value store and relies on commands that do not have a unified query language. Redis has an embedded LUA interpreter that is recommended to disable.

Interview the system administrator and ask if the practice of disabling LUA scripting is a documented practice or has been completed. To check if LUA scripting is disabled on the desired database:
1. Connect to one of the nodes/servers in the redis enterprise cluster as an admin (sudo su -).
2. Type: rladmin status to get the DB ID of the database on which LUA scripting is to be disabled
3. Run the following command, substituting in the bdb_id from the previous step:
ccs-cli hget bdb:<bdb_id>

If the response is NIL or doesn't return EVAL, EVALSHA, this is a finding.

If no documentation exists or if the database otherwise accepts LUA scripts, this is a finding.

Vulnerability Number

V-251250

Documentable

False

Rule Version

RD6X-00-011900

Severity Override Guidance

Redis does not rely on a query language and there is no known method of SQL injection that would apply to Redis. Redis is a key value store and relies on commands that do not have a unified query language. Redis has an embedded LUA interpreter that is recommended to disable.

Interview the system administrator and ask if the practice of disabling LUA scripting is a documented practice or has been completed. To check if LUA scripting is disabled on the desired database:
1. Connect to one of the nodes/servers in the redis enterprise cluster as an admin (sudo su -).
2. Type: rladmin status to get the DB ID of the database on which LUA scripting is to be disabled
3. Run the following command, substituting in the bdb_id from the previous step:
ccs-cli hget bdb:<bdb_id>

If the response is NIL or doesn't return EVAL, EVALSHA, this is a finding.

If no documentation exists or if the database otherwise accepts LUA scripts, this is a finding.

Check Content Reference

M

Target Key

5443