Request for Guidance: Enable Redis Password Auth for UX NextGen to Address Critical Vulnerability

Apliqo UX
1

Hi Team,

We have newly deployed UX NextGen in a customer environment, and vulnerability scanning has reported a critical finding.

Vulnerability Details

  • Vulnerability Name: Redis Server Without Password Authentication (Plugin ID: 100634)
  • Risk Level: Critical
  • CVSS v3 Score: 9.8
  • Affected Port: 6379
  • Installed Redis Version: 8.8.0
  • Description: The Redis server has no password‑based authentication enabled. Unauthenticated clients can retrieve server information via INFO commands, exposing an unauthorised‑access risk.

Could you please advise whether it is supported to set a password for Redis in this UX NextGen deployment?

If supported, kindly share the detailed procedure and the exact configuration files that require modification.

If password configuration is not available in the current release, can I submit a feature request to add Redis password support and related configuration options in future versions?

Thanks,

Finch

2

Hi Finch,

There is no quick and easy workaround to setup redis authorization in the .env for the container cluster. To support this we need to add redis auth handling for apliqo-api which we can’t do without a release.

HOWEVER - a local fix is easy as the public redis port can simply be closed. This doesn’t affect the application as apliqo-api communicates with redis through private docker network and public redis port is not used. There is therefore no requirement for it to be exposed.

So you can just remove ports section for apliqo-redis container in docker-compose.yml. This should address the security concern.