I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability.
The website in question has a "patch me" button, and if you have a password-less Redis server running on your machine, it will patch it.
In other words, the website itself connects to the Redis Server in your computer and executes some commands.
If you look into the website code you find, predictably, this:
var text = "the code to run"; var bad = "EVAL " + JSON.stringify(text) + " 0\r\n"; var x = new XMLHttpRequest(); x.open("POST", "http://localhost:6379"); x.send(bad);
To my surprise, this works!
I thought the Cross-Domain Policy would stop this from running, but it doesn't.
Why does this work, and how can I now not be paranoid that every website I go into is reading the entire contents of my Redis server?
It is because it's only writing but not reading? Still, any website in the world could empty my local Redis server / write to anything else listening to a port in my machine without authentication.
Am I missing anything here?