Memcache Port 11211 Unauthorized access vulnerability

Vulnerability Description:
Memcache is a commonly used key-value caching system, because it does not have permission control module, so the Memcache service of open Extranet is easily detected by attackers, and the sensitive information in Memcache can be read directly through command interaction.

Repair scheme:
because Memcache has no permission control function, users are required to restrict the access source.

Programme I:

If the memcache is not necessary to open the extranet, you can specify the binding IP address of 127.0.0.1 when the memcached is started. For example:

Memcached-d-M 1024-u root-l 127.0.0.1-p 11211-c 1024-p/tmp/memcached.pid

Where the-l parameter is specified as a native address.

Option two: (Note: Please configure iptables rules carefully)

If the Memcache service needs to provide services externally, access control is available through Iptables, which is only allowed for native access:

Accept
# iptables-a input-p tcp-s 127.0.0.1--dport 11211-j ACCEPT
# iptables-a input-p udp-s 127.0.0.1--dport 11211-j ACCEPT

Drop
# iptables-i input-p TCP--dport 11211-j DROP
# iptables-i input-p UDP--dport 11211-j DROP

Save rule and restart Iptables
# Service Iptables Save
# Service Iptables Restart

The above rules mean that only 192.168.0.2 this IP is allowed to access 11211 ports.

Verify Memcache Port 11211 is open
Take IP (1.2.3.4) as an example:

Telnet 1.2.3.4 11211

Without a username password, you can directly connect to the 11211 port of the Memcache service.

Perform the following command to obtain the appropriate result:

# Stats//view Memcache service status
# Stats Items//View all items
# stats Cachedump 32 0//Get cache key
# get:state:264861539228401373:261588//Read the corresponding value through key, obtain the actual cache content, causing sensitive information leakage