{"record":{"id":"350a44d902f2a593","repo":"shadow1ng/fscan","slug":"i18n-gettext-memcached-access-failed","errorCode":null,"errorMessage":"i18n.GetText(\"memcached_access_failed\")","messagePattern":"i18n\\.GetText\\(\"memcached_access_failed\"\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"plugins/services/memcached.go","lineNumber":45,"sourceCode":"func (p *MemcachedPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {\n\tconfig := session.Config\n\ttarget := info.Target()\n\n\tif config.DisableBrute {\n\t\treturn p.identifyService(ctx, info, session)\n\t}\n\n\t// 检测未授权访问\n\tif result := p.testUnauthorizedAccess(ctx, info, session); result != nil && result.Success {\n\t\tsession.LogVuln(i18n.Tr(\"memcached_unauth\", target))\n\t\treturn result\n\t}\n\n\t// Memcached通常不需要认证，如果上面检测失败则服务可能不可用\n\treturn &ScanResult{\n\t\tSuccess: false,\n\t\tService: \"memcached\",\n\t\tError:   fmt.Errorf(\"%s\", i18n.GetText(\"memcached_access_failed\")),\n\t}\n}\n\n// testUnauthorizedAccess 测试Memcached未授权访问\nfunc (p *MemcachedPlugin) testUnauthorizedAccess(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *ScanResult {\n\tconn := p.connectToMemcached(ctx, info, session)\n\tif conn == nil {\n\t\treturn nil\n\t}\n\tdefer func() { _ = conn.Close() }()\n\n\tif p.testBasicCommand(conn, session.Config) {\n\t\treturn &ScanResult{\n\t\t\tType:    plugins.ResultTypeVuln,\n\t\t\tSuccess: true,\n\t\t\tService: \"memcached\",\n\t\t\tBanner:  i18n.GetText(\"service_unauthorized\"),\n\t\t}","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/memcached.go#L27-L63","documentation":"The memcached Scan plugin returns this error when brute-force mode is enabled (DisableBrute is false) but the unauthenticated-access probe fails: either the TCP connection to the memcached port could not be established (connectToMemcached returned nil) or the 'version' command probe did not elicit a VERSION/memcached response. Since memcached normally has no authentication, fscan treats failure of the unauth check as evidence the service is not reachable/usable and reports 'memcached access failed'. It is a scan-level negative result, not a Go panic.","triggerScenarios":"Calling Scan on a memcached-registered port (11211-11213) with brute enabled when: the target refuses or times out on the TCP dial; the context is cancelled mid-dial; the server accepts TCP but does not answer 'version\\r\\n' with a string containing 'VERSION' or 'memcached'.","commonSituations":"Scanning a host where memcached is bound to localhost only or firewalled; a non-memcached service (e.g. another daemon) listening on 11211; network latency exceeding ModuleTimeout; the target is actually running a memcached variant that suppresses the version banner.","solutions":["Verify the target actually exposes memcached on the scanned port (telnet/nc to 11211 and send 'version\\r\\n').","Check firewall/security-group rules allowing inbound TCP to 11211 from the scanning host.","Increase the module timeout so slow links are not mistaken for dead services.","Confirm the port list; the plugin only runs on 11211/11212/11213, so re-run with the correct port if memcached listens elsewhere.","If the server requires SASL or a proxy banner, inspect its response manually and treat this result as a false negative."],"exampleFix":"// before\nif result := p.testUnauthorizedAccess(ctx, info, session); result != nil && result.Success { ... }\nreturn &ScanResult{Success: false, Error: fmt.Errorf(\"%s\", i18n.GetText(\"memcached_access_failed\"))}\n// after\n// pre-check reachability in the caller before interpreting the result as 'access failed'\nconn, err := net.DialTimeout(\"tcp\", \"10.0.0.5:11211\", 3*time.Second)\nif err != nil { log.Println(\"port closed, memcached_access_failed is expected\") } else { conn.Close() }","handlingStrategy":"fallback","validationCode":"func memcachedReachable(host string, port int, timeout time.Duration) bool {\n\tconn, err := net.DialTimeout(\"tcp\", fmt.Sprintf(\"%s:%d\", host, port), timeout)\n\tif err != nil { return false }\n\tdefer conn.Close()\n\tconn.SetDeadline(time.Now().Add(timeout))\n\tif _, err := conn.Write([]byte(\"version\\r\\n\")); err != nil { return false }\n\tbuf := make([]byte, 256)\n\tn, err := conn.Read(buf)\n\treturn err == nil && strings.Contains(string(buf[:n]), \"VERSION\")\n}","typeGuard":"func isScanFailureWithReason(r *services.ScanResult, reason string) bool {\n\treturn r != nil && !r.Success && r.Error != nil && strings.Contains(r.Error.Error(), reason)\n}","tryCatchPattern":"result := plugin.Scan(ctx, info, session)\nif !result.Success && result.Error != nil {\n\tif isScanFailureWithReason(result, \"memcached\") {\n\t\tlog.Printf(\"memcached probe failed on %s: %v (treat as unavailable)\", info.Target(), result.Error)\n\t} else {\n\t\tlog.Printf(\"unexpected scan error: %v\", result.Error)\n\t}\n}","preventionTips":["Pre-verify port 11211 reachability before running the memcached plugin","Tune ModuleTimeout to exceed worst-case network RTT","Check firewall/security-group rules for the scanner's source IP","Manually confirm the 'version' banner responds before trusting scan-negative results"],"tags":["memcached","network","scan-plugin","unauthorized-access"],"backgroundTag":"connection-refused","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}