redis-exporter-metrics: Redis Exporter Metrics - Exposure

2026-05-09 Redis Exporter Metrics PoC Public

Description

Redis Exporter metrics endpoint is exposed.

PoC

id: redis-exporter-metrics

info:
  name: Redis Exporter Metrics - Exposure
  author: koungq
  severity: low
  description: Redis Exporter metrics endpoint is exposed.
  reference:
    - https://github.com/oliver006/redis_exporter
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
  tags: redis,exporter,metrics,exposure,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/metrics"

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "redis_connected_clients", "redis_memory_used_bytes", "redis_instance_info")'
          - 'contains_all(body, "# HELP", "redis_exporter_build_info", "redis_up")'
          - 'contains(content_type, "text/plain")'
          - 'status_code == 200'
        condition: and
# digest: 490a0046304402201135687665d51ddf28b5fcf57259dfb8017daa2d1c0da2593dbd770e3aa2bf09022035b8856a2a7a0b431438cb53583f372d35afc45d724692f70a0158f1938bc990:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/misconfiguration/redis-exporter-metrics.yaml

References

Related Vulnerabilities