Redis Entirely Accessible
- Query id: fd8da341-6760-4450-b26c-9f6d8850575e
- Query name: Redis Entirely Accessible
- Platform: Terraform
- Severity: High
- Category: Networking and Firewall
- URL: Github
Description¶
Firewall rule allowing unrestricted access to Redis from the Internet
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - tf file
resource "azurerm_redis_cache" "positive1" {
name = "redis${random_id.server.hex}"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
capacity = 1
family = "P"
sku_name = "Premium"
enable_non_ssl_port = false
redis_configuration {
maxclients = 256
maxmemory_reserved = 2
maxmemory_delta = 2
maxmemory_policy = "allkeys-lru"
}
}
resource "azurerm_redis_firewall_rule" "positive2" {
name = "someIPrange"
redis_cache_name = azurerm_redis_cache.example.name
resource_group_name = azurerm_resource_group.example.name
start_ip = "0.0.0.0"
end_ip = "0.0.0.0"
}
Code samples without security vulnerabilities¶
Negative test num. 1 - tf file
resource "azurerm_redis_cache" "negative1" {
name = "redis${random_id.server.hex}"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
capacity = 1
family = "P"
sku_name = "Premium"
enable_non_ssl_port = false
redis_configuration {
maxclients = 256
maxmemory_reserved = 2
maxmemory_delta = 2
maxmemory_policy = "allkeys-lru"
}
}
resource "azurerm_redis_firewall_rule" "negative2" {
name = "someIPrange"
redis_cache_name = azurerm_redis_cache.example.name
resource_group_name = azurerm_resource_group.example.name
start_ip = "10.2.3.4"
end_ip = "10.3.4.5"
}