How to determine the Redis attack source?

10/9/2019

I am using a Redis Docker image in Kubernetes, everything was working fine with my programs that connect to Redis using both the R client (rredis) and the Python client (redis) until recently when the Redis pod started logging the following error:

Possible SECURITY ATTACK detected. It looks like somebody is sending POST or Host: commands to Redis. This is likely due to an attacker attempting to use Cross Protocol Scripting to compromise your Redis instance. Connection aborted.

I found a post that indicated it could be due to the my system's health checks. How would I determine if that is the case? How would I determine the origination of the attacks, please?

-- calycolor
docker
kubernetes
redis

0 Answers