PT-2021-23147 · As Redis · As Redis

Cc7V@校长 · Published 2021-10-26 · Updated 2021-10-27 · CVE-2021-41172

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions AS Redis versions prior to 0.5

Description The issue arises from insufficient input validation and sanitization via Redis server configuration, leading to Self-XSS in the plugin configuration. This results in code execution.

Recommendations For versions prior to 0.5, update to version 0.5 to resolve the issue. As a temporary workaround, consider restricting access to the Redis server configuration to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41172

GHSA-J8J6-F829-W425

Affected Products

As Redis

References · 6

• 🔥 https://github.com/AntSword-Store/AS_Redis/issues/1 · Exploit
• 🔥 https://mp.weixin.qq.com/s/yjuG6DLT_bSRnpggPj21Xw · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-41172 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41172 · Vendor Advisory
• https://github.com/Medicean/AS_Redis/security/advisories/GHSA-j8j6-f829-w425 · Note
• https://t.me/cibsecurity/31229 · Telegram Post