Vulnerability · Published Apr 27, 2021 · Assigned by GitHub_M

CVE-2021-29442Authentication bypass

High 8.6

In plain English

A high-severity missing authentication in nacos from alibaba. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 64.2% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)64.2%top 0.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling2Nuclei, Public PoC

Official description

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.alibaba.nacos:nacos-common	1.4.1	GHSA-36hp-jr8h-556f
Maven	com.alibaba.nacos:nacos-common	1.4.1	GHSA-xv5h-v7jh-p2qh

Affected products (as reported)

Vendor	Product	Versions
alibaba	nacos	< 1.4.1

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/alibaba/nacos/issues/4463 x_refsource_MISC
https://github.com/advisories/GHSA-36hp-jr8h-556f x_refsource_CONFIRM
https://github.com/alibaba/nacos/pull/4517 x_refsource_MISC