STIGQter: STIG Summary: Redis Enterprise 6.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 24 Oct 2024:

Redis Enterprise DBMS and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.

DISA Rule

SV-251251r961158_rule

Vulnerability Number

V-251251

Group Title

SRG-APP-000251-DB-000392

Rule Version

RD6X-00-012000

Severity

CAT II

CCI(s)

• CCI-001310 - Checks the validity of organization-defined information inputs to the system.

Weight

10

Fix Recommendation

Redis does not rely on a query language and there is no known method of SQL injection that would apply to Redis. Redis is a key value store and relies on commands that do not have a unified query language. Redis has an embedded LUA interpreter that is recommended to disable.

To disable the interpreter run the following REST API command:
curl -v -kL -u "<user>:<password>" --location-trusted -H "Content-type: application/json" -d '{ "disabled_commands": "EVAL, EVALSHA" }' -X PUT https://<URL>:PORT/v1/bdbs/<DB_ID>

Check Contents

Redis does not rely on a query language and there is no known method of SQL injection that would apply to Redis. Redis is a key value store and relies on commands that do not have a unified query language. Redis has an embedded LUA interpreter that is recommended to disable.

Interview the system administrator and ask if the practice of disabling LUA scripting is a documented practice or has been completed. To check if LUA scripting is disabled on the desired database:
1. Connect to one of the nodes/servers in the redis enterprise cluster as an admin (sudo su -).
2. Type: rladmin status to get the DB ID of the database on which LUA scripting is to be disabled.
3. Run the following command, substituting in the bdb_id from the previous step:
ccs-cli hget bdb:<bdb_id>

If the response is NIL or doesn't return EVAL, EVALSHA, this is a finding

If no documentation exists or if the database otherwise accepts LUA scripts, this is a finding.

Vulnerability Number

V-251251

Documentable

False

Rule Version

RD6X-00-012000

Severity Override Guidance

Redis does not rely on a query language and there is no known method of SQL injection that would apply to Redis. Redis is a key value store and relies on commands that do not have a unified query language. Redis has an embedded LUA interpreter that is recommended to disable.

Interview the system administrator and ask if the practice of disabling LUA scripting is a documented practice or has been completed. To check if LUA scripting is disabled on the desired database:
1. Connect to one of the nodes/servers in the redis enterprise cluster as an admin (sudo su -).
2. Type: rladmin status to get the DB ID of the database on which LUA scripting is to be disabled.
3. Run the following command, substituting in the bdb_id from the previous step:
ccs-cli hget bdb:<bdb_id>

If the response is NIL or doesn't return EVAL, EVALSHA, this is a finding

If no documentation exists or if the database otherwise accepts LUA scripts, this is a finding.

Check Content Reference

M

Target Key

5443