Source: Audit findings (LOW, partially covered)
Three related disclosures of internal state to unauthenticated callers:
-
INFO command (`src/command/server_cmds.rs:69-142`): returns memory usage, key counts, OS info, db sizes, hit/miss counts before AUTH is checked. Acceptable when no `requirepass` is set, but with auth enabled INFO should be restricted to authenticated clients.
-
Latency stats (`src/server/connection.rs:199-207`): command names are recorded in latency stats even when the command failed because the client wasn't authed. The names leak through INFO commandstats and LATENCY HISTORY.
-
HTTP /metrics: already gated behind C5's bearer-auth fix in 0.11.0, but kept here for completeness — verify there is no equivalent leak via the RESP `LATENCY` family before close.
Suggested approach:
- Gate INFO behind the same auth check that other commands use; allow `INFO server` for the unauth banner only
- Only record latency stats after the ACL/auth permission check succeeds
- Document which sections of INFO are considered safe pre-auth (e.g. version/role) vs. sensitive (memory, keyspace)
Source: Audit findings (LOW, partially covered)
Three related disclosures of internal state to unauthenticated callers:
INFO command (`src/command/server_cmds.rs:69-142`): returns memory usage, key counts, OS info, db sizes, hit/miss counts before AUTH is checked. Acceptable when no `requirepass` is set, but with auth enabled INFO should be restricted to authenticated clients.
Latency stats (`src/server/connection.rs:199-207`): command names are recorded in latency stats even when the command failed because the client wasn't authed. The names leak through INFO commandstats and LATENCY HISTORY.
HTTP /metrics: already gated behind C5's bearer-auth fix in 0.11.0, but kept here for completeness — verify there is no equivalent leak via the RESP `LATENCY` family before close.
Suggested approach: