PT-2021-3840 · Nacos · Nacos
Threedr3Am
·
Published
2021-04-07
·
Updated
2021-08-25
·
CVE-2021-29441
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Nacos versions prior to 1.4.1
Description
The issue is related to the AuthFilter component of the Nacos platform, which can be exploited to bypass authentication through spoofing. This may allow a remote attacker to elevate their privileges. The vulnerability relies on the
user-agent HTTP header, making it easily spoofable. The issue can be exploited by sending a request to the "http://127.0.0.1:8848/nacos/v1/cs/configs" endpoint with a spoofed user-agent header set to Nacos-Server, allowing the attacker to carry out administrative tasks on the Nacos server.Recommendations
For Nacos versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the
AuthFilter servlet filter to minimize the risk of exploitation. Avoid using the user-agent HTTP header to enforce authentication until the issue is resolved.Exploit
Fix
Authentication Bypass by Spoofing
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Nacos